CVE-2026-40875: mailcow: dockerized vulnerable to stored XSS in user login history real_rip
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser tab. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40875?
CVE-2026-40875 has a medium severity level due to the potential for stored XSS vulnerabilities leading to security risks.
How do I fix CVE-2026-40875?
To fix CVE-2026-40875, update Mailcow: dockerized to version 2026-03b or later where the vulnerability is patched.
What components are affected by CVE-2026-40875?
CVE-2026-40875 affects Mailcow: dockerized versions prior to 2026-03b, specifically the user dashboard's login history feature.
What kind of vulnerability is CVE-2026-40875?
CVE-2026-40875 is a stored Cross-Site Scripting (XSS) vulnerability affecting the rendering of client IP addresses in user login logs.
Who can be impacted by CVE-2026-40875?
CVE-2026-40875 impacts users of Mailcow: dockerized as their login history feature can be exploited to execute malicious scripts.