Stored Cross-Site Scripting in Mailcow-dockerized by Mailcow
CVE-2026-7460

7.4HIGH

Key Information:

Vendor

Mailcow

Status
Mailcow-dockerized
Vendor
CVE Published:
20 May 2026

What is CVE-2026-7460?

A vulnerability in Mailcow-dockerized allows stored cross-site scripting through its administrator Queue Manager. This occurs as the Queue Manager fetches mail queue entries and improperly incorporates server-controlled Postfix queue fields into the HTML rendering of DataTables rows without sufficient output encoding, exposing systems to XSS attacks.

Affected Version(s)

mailcow-dockerized Windows 2026-03b

References

https://fluidattacks.com/advisories/mojabi
third-party-advisory
https://github.com/mailcow/mailcow-dockerized
product

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Oscar Naveda
.