The vulnerability exists in mailcow‑dockerized versions older than 2026‑03b. The user dashboard logs the client IP from the X‑Real‑IP header without applying HTML escaping, so an attacker can embed malicious HTML or JavaScript in that field. Although the flaw is a stored self‑XSS, a Login CSRF can force a victim to log into an attacker‑controlled account; the injected script then runs in the victim’s browser and can read the content of the victim’s mail in the previous tab, exposing private information.

The affected product is the mailcow‑dockerized groupware/email suite. All releases prior to the 2026‑03b tag are vulnerable. The fix was committed in that tag and later releases do not contain the flaw.

With a CVSS score of 7, the issue is considered high‑severity. An EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, indicating limited publicly documented exploitation. The flaw relies on a trusted X‑Real‑IP header that many deployments accept unvalidated, which an attacker can supply. Because it is a self‑XSS that requires end‑user interaction, the attacker must trick the victim into executing the payload—this can be achieved through a Login CSRF that forces the victim to log in to a compromised account. Once the payload runs, it can arbitrarily read the victim’s email data, causing a confidentiality breach.