CVE-2026-7460 — mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/a…
Published: 2026-05-20 · CVSS: 7.4 · CVSS 4.0
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7