The mailcow-dockerized email suite has multiple security vulnerabilities in versions prior to 2026-03b, including lack of administrator verification, HTML/JS injection, SQL injection, and improper rendering of user data.

🚨 EUVD-2026-24255 📊 Score: 8.9/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24255 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24256 📊 Score: 6.0/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call thi... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24256 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24258 📊 Score: 7.0/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24258 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24253 📊 Score: 7.2/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores q... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24253 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24254 📊 Score: 9.3/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24254 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24262 📊 Score: 2.1/10 (CVSS v3.1) 📦 Product: mailcow-dockerized 🏢 Vendor: mailcow 📅 Updated: 2026-04-21 📝 mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24262 #cybersecurity #infosec #euvd #cve #vulnerability