CVE-2026-40874: mailcow: dockerized missing authorization on Forwarding Hosts delete action
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with /api/v1/delete/fwdhost. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40874?
CVE-2026-40874 has been classified as a high severity vulnerability due to the lack of authorization checks.
How do I fix CVE-2026-40874?
To fix CVE-2026-40874, upgrade to mailcow: dockerized version 2026-03b or later.
What impact does CVE-2026-40874 have on security?
CVE-2026-40874 allows unauthorized users to delete Forwarding Hosts, which can lead to potential data loss.
Is my version affected by CVE-2026-40874?
If you are using a version of mailcow: dockerized prior to 2026-03b, your installation is vulnerable to CVE-2026-40874.
What actions should be taken if I am vulnerable to CVE-2026-40874?
If vulnerable to CVE-2026-40874, immediate action is to upgrade your mailcow: dockerized installation to the secure version.