A second‑order SQL injection exists in mailcow:mailcow-dockerized where the quarantine_category field from the /api/v1/add/mailbox endpoint is stored without validation. When the quarantine_notify.py process later builds SQL queries using unsafe string formatting, an attacker can inject arbitrary SQL such as a UNION SELECT, allowing extraction of sensitive data like administrator credentials. The flaw does not enable immediate code execution but can compromise the database and disclose confidential information.

Affected are installations of mailcow:mailcow-dockerized running any version prior to 2026-03b. The vulnerability was addressed in the 2026-03b release, and any newer version is considered fixed.

The CVSS score of 7.2 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote through the API, requiring authenticated access to the /api/v1/add/mailbox endpoint. An attacker who can send a crafted request and later trigger the quarantine notification job can execute arbitrary SQL queries against the database, leading to data exfiltration.