CVE-2017-8928
HighSummary
Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized actions on behalf of a logged-in user, potentially leading to data loss or security breaches.
Recommendation
It is recommended to upgrade to the latest version of mailcow that addresses this vulnerability and to implement additional protections against CSRF attacks.
Other vulnerabilities in mailcow 0.14
See all- CVE-2026-40878Low
In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
- CVE-2026-40874Medium
In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.
- CVE-2023-34108High
A vulnerability has been discovered in mailcow, a mail server suite, that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which verifies user passwords during login attempts.
Original NVD description (English source)
mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS