CVE-2026-40872

CVE-2026-40872 is a stored cross-site scripting (XSS) vulnerability in mailcow: dockerized versions prior to 2026-03b, affecting the admin dashboard's Autodiscover logs functionality. The vulnerability allows an attacker to inject HTML/JavaScript payloads through a crafted EMailAddress field in an unauthenticated Autodiscover request, which is then stored in Redis and executed when an administrator accesses the logs. The attack requires no authentication and leverages the failure to HTML-escape the EMailAddress value in the logs output, making it a network-accessible vulnerability with low complexity. While specific impact details are not provided, successful exploitation would allow attackers to execute arbitrary JavaScript in the admin's browser session, potentially leading to account compromise, administrative action manipulation, or credential theft. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on exploit tracking platforms. The EPSS score of 0.00047 indicates extremely low probability of exploitation, and no public exploit code appears to be available, though the straightforward nature of XSS vulnerabilities suggests proof-of-concept development would be trivial for motivated attackers.