CVE-2026-40874
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.
Risk Assessment
An authenticated non-admin user can delete forwarding hosts, causing mail delivery disruptions or other service outages.
Recommendation
Update mailcow to version 2026-03b or later. Until then, restrict API access and monitor for unauthorized calls.
Other vulnerabilities in mailcow
See all- CVE-2017-8928High
Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.
- CVE-2026-40878Low
In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
- CVE-2023-34108High
A vulnerability has been discovered in mailcow, a mail server suite, that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which verifies user passwords during login attempts.
Original NVD description (English source)
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS