https://reddit.com/r/cybersecurity/comments/1spvqrv/found_and_reported_a_secondorder_sql_injection_in/: Found and reported a Second-Order SQL Injection in mailcow (CVE-2026-40871) – High severity
Published Apr 19, 2026
·Updated
Affected Software
1 affected component
Mailcow mailcow-dockerized
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs Mailcow API access that permits creating mailboxes through the /api/v1/add/mailbox endpoint. The malicious value is supplied in the quarantine_category field during mailbox creation.
2
When is the injected SQL executed, and what could it expose?
The stored value is later used when quarantine_notify.py runs as part of quarantine notification jobs. The issue can enable arbitrary SQL execution and exfiltration of sensitive data, including admin credentials, through notification emails.