An unauthenticated Autodiscover request can inject an EMailAddress value containing arbitrary HTML or JavaScript. The mailcow admin dashboard renders this value in the Autodiscover logs without escaping, storing the payload in Redis and executing it whenever an administrator views the logs. This stored cross‑site scripting can enable an attacker to run malicious scripts in the context of the logged‑in admin, potentially stealing session cookies or performing privileged actions.

The issue affects installations of mailcow:mailcow-dockerized that are running any version prior to 2026-03b. Users who have not upgraded to 2026-03b or later are vulnerable.

With a CVSS score of 9.3, the vulnerability is considered critical. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the attack vector is network based through the Autodiscover endpoint. An attacker only needs to send a crafted Autodiscover request; no authentication is required. Once a malicious EMailAddress is logged, any administrator who opens the Autodiscover logs will execute the stored script in their browser, giving the attacker the capabilities of that admin account.