mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.
The mailcow admin panel displays Autodiscover request logs, including the EMailAddress field (presented as 'user'), without applying HTML escaping. An attacker sends an unauthenticated Autodiscover request with a specially crafted EMailAddress value containing HTML or JavaScript code. The malicious payload is then stored in Redis, and when an administrator opens the Autodiscover logs view in the panel, the code is executed in their browser session.
An attacker can execute arbitrary JavaScript code in the context of an administrator's session, which may lead to session hijacking, theft of authentication credentials, or execution of unauthorized administrative actions. The vulnerability may also affect systems linked to the administrator account (SC:H, SI:H).
mailcow: dockerized should be updated to version 2026-03b or newer, which fixes the vulnerability by introducing proper HTML escaping for the EMailAddress field in Autodiscover logs.
mailcow: dockerized in versions prior to 2026-03b
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X