CVE-2026-40871

mailcow: dockerized versions prior to 2026-03b contain a second-order SQL injection vulnerability in the quarantine_category field accessible through the Mailcow API. An attacker with high privileges can inject malicious SQL through the /api/v1/add/mailbox endpoint, which stores the unsanitized input. The vulnerability is triggered later when quarantine_notify.py executes scheduled notification jobs using unsafe string formatting instead of parameterized queries, allowing SQL injection to occur during delayed processing. The vulnerability presents a high severity risk with a CVSS score of 7.2, requiring network access but no user interaction. The attack requires high privilege access, though an attacker with administrative credentials or compromised admin accounts can exploit it to exfiltrate sensitive data such as admin credentials. The impact extends across confidentiality, integrity, and availability, as attackers can extract, modify, or delete data rendered in quarantine notification emails. Currently, this vulnerability shows no active exploitation in the wild, with an EPSS score of 0.00042 indicating minimal real-world exploitation activity. No public exploit code is readily available, and community attention remains low. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog, and administrators should prioritize patching to version 2026-03b to mitigate the risk before exploitation increases.