mailcow-dockerized
2026-11mailcow: dockerized - 🐮 + 🐋 = 💕
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- GPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories3 critical, 14 high, 9 medium, 4 low · Scorecard 5.7/10
- Supported versions
- No scheduleendoflife.date does not track this project
13.8k stars · 1.9k forks · 506 open issues · last release 10 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 critical, 14 high, 9 medium, 4 low. Check the patched version against the one you run.
- mediumGHSA-6v9c-2j28-pfhvNov 10, 2026"Manage app passwords" permission only enforced in the web interface
- Affected
- < 2026-11
- Patched in
- >= 2026-11
- mediumGHSA-xvvm-8287-x8f9Nov 10, 2026TOTP 2FA brute-force with a known password due to missing rate limiting on TFA verification
- Affected
- < 2026-11
- Patched in
- >= 2026-11
- lowGHSA-vv9q-w88c-j8h7Nov 10, 2026Cross-Tenant Quarantine Metadata Disclosure via Unescaped Domain Regex
- Affected
- < 2026-11
- Patched in
- >= 2026-11
- highGHSA-rpvp-3pw9-3vcwNov 10, 2026Failed ActiveSync/DAV/autodiscover logins are never banned (counted as 127.0.0.1), and passwordless autodiscover reveals which mailboxes exist
- Affected
- < 2026-11
- Patched in
- >= 2026-11
- criticalGHSA-jgr3-fv33-x43cNov 10, 2026Domain admin: stored SSTI in domain_wide_footer → RCE in the shared rspamd container (cross-tenant)
- Affected
- < 2026-11
- Patched in
- >= 2026-11
- lowGHSA-9x37-r659-wxq8Nov 10, 2026Unauthenticated OAuth 2.0 Authorization Code Issuance to a Null User
- Affected
- < 2026-07b
- Patched in
- 2026-07b
- highGHSA-xrq6-h4qm-x38vNov 10, 2026Stored XSS in admin log tables via unescaped mail-header fields (Rspamd history / ratelimits)
- Affected
- < 2026-07a
- Patched in
- >= 2026-07a
- highGHSA-5928-v56c-g8x5Nov 10, 2026SMTP command injection in quarantine quick-release (raw)
- Affected
- < 2026-07a
- Patched in
- >= 2026-07a
- highGHSA-76cm-26jx-jmhrNov 10, 2026Stored XSS via mailbox Full name field, domain admin to super admin
- Affected
- < 2026-07a
- Patched in
- >= 2026-07a
- mediumGHSA-5r27-4qj3-354fNov 10, 2026Replayable Domain Admin SSO token
- Affected
- < 2026-07a
- Patched in
- >= 2026-07a
- highCVE-2026-40875Apr 16, 2026Stored XSS in user login history real_rip
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- mediumCVE-2026-40874Apr 16, 2026Missing authorization on Forwarding Hosts delete action
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- highCVE-2026-40873Apr 16, 2026Stored XSS in Quarantine attachment filenames
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- criticalCVE-2026-40872Apr 16, 2026Stored XSS in autodiscover logs email address field
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- highCVE-2026-40871Apr 16, 2026Second Order SQL Injection in quarantine category via API
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- lowCVE-2026-40878Apr 16, 2026Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
- Affected
- < 2026-03b
- Patched in
- >= 2026-03b
- criticalCVE-2025-53909Jul 17, 2025SSTI in Quota and Quarantine Notification Template
- Affected
- < 2025-07
- Patched in
- >= 2025-07
- highCVE-2025-25198Feb 12, 2025Password reset poisoning
- Affected
- < 2025-01a
- Patched in
- >= 2025-01a
- highCVE-2024-56529Jan 28, 2025Session Fixation on mailcow web panel
- Affected
- <= 2024-11b
- Patched in
- <= 2025-01
- mediumCVE-2024-41958Aug 5, 2024Two-Factor Authentication (2FA) Bypass Vulnerability
- Affected
- < 2024-07
- Patched in
- >= 2024-07
- highCVE-2024-41959Aug 5, 2024XSS Vulnerability via API Logs
- Affected
- < 2024-07
- Patched in
- >= 2024-07
- lowCVE-2024-41960Aug 5, 2024XSS Vulnerability via Relay Hosts Configuration
- Affected
- < 2024-07
- Patched in
- >= 2024-07
- mediumCVE-2024-30270Apr 4, 2024Path Traversal and Arbitrary Code Execution Vulnerability
- Affected
- < 2024-04.
- Patched in
- >= 2024-04.
- mediumCVE-2024-31204Apr 4, 2024XSS Vulnerability via Exception Handler
- Affected
- < 2024-04
- Patched in
- >= 2024-04
- highCVE-2024-24760Feb 2, 2024Docker Container Exposure to Local Network
- Affected
- < 2024-01c
- Patched in
- >= 2024-01c
- mediumCVE-2024-23824Feb 2, 2024Pixel flood attack leads to Denial of Service in admin page
- Affected
- <= 2023-12b
- Patched in
- >= 2024-01
- highCVE-2023-49077Nov 27, 2023XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation
- Affected
- < 2023-11
- Patched in
- >= 2023-11
- highCVE-2023-34108Jun 7, 2023Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords
- Affected
- <= 2023-05
- Patched in
- >= 2023-05a
- highCVE-2023-26490Mar 3, 2023Shell command injection via xoauth2 authentication in imapsync
- Affected
- < 2023-03
- Patched in
- >= 2023-03
- mediumCVE-2022-39258Sep 27, 2022Possible Phishing attacks through Swagger UI
- Affected
- < 2022-09
- Patched in
- >= 2022-09