CVE-2026-40875

CVE-2026-40875 affects mailcow: dockerized (open source groupware/email suite). The vulnerability lies in the user dashboard’s login-history field (Seen successful connections) where the client IP is rendered without escaping HTML, relying on the X-Real-IP header for the source IP in logs. This e...

CVE-2024-41958 Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication 2FA mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accounts that are otherwi...

PT-2024-20538 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow versions prior to 2024-01c Description: A security issue has been identified in mailcow, a dockerized email package. This issue potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even wh...