Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
CVE-2026-40874: mailcow dockerized allows any user to delete forwarding hosts
CVE-2026-40874 · published 6 months ago
Summary
In mailcow dockerized versions before the March 2026 update, any signed‑in user could call an API endpoint to remove forwarding host entries without admin approval. Deleting these entries can interrupt email routing and delivery. Upgrade to the March 2026 release or later to restore proper permission checks.
Original advisory text
mailcow: dockerized missing authorization on Forwarding Hosts delete action
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published21 Apr 2026
Updated26 Oct 2026
First seen21 Apr 2026
Track software like this
Free during beta