CVE-2026-40874

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with "/api/v1/delete/fwdhost". Any authenticated user can call this API. Checks are only applied for edit/add action...