CVE-2026-7460: mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

Published May 20, 2026

Updated

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.

This issue affects mailcow-dockerized: 2026-03b.

Affected Software

1 affected component

Mailcow mailcow-dockerized=2026-03b

Event History

May 20, 2026

CVE Published

via MITRE·02:19 AM

Data Sourced

via MITRE·02:19 AM

DescriptionWeakness

Data Sourced

via NVD·04:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-7460?

CVE-2026-7460 is classified as a stored cross-site scripting (XSS) vulnerability affecting the Queue Manager in mailcow-dockerized version 2026-03b.

How do I fix CVE-2026-7460?

To fix CVE-2026-7460, update your mailcow-dockerized installation to a version that includes the security patch for this vulnerability.

What components are affected by CVE-2026-7460?

CVE-2026-7460 affects the Queue Manager of the mailcow-dockerized software where unescaped inputs can lead to stored XSS.

Who is vulnerable to CVE-2026-7460?

Any installation of mailcow-dockerized version 2026-03b is vulnerable to CVE-2026-7460 if the Queue Manager is accessible.

Can CVE-2026-7460 be exploited remotely?

Yes, CVE-2026-7460 can be exploited remotely by an attacker who can inject malicious scripts via the Queue Manager interface.