mailcow-dockerized Stored Cross-Site Scripting Vulnerability in Queue Manager

A stored cross-site scripting vulnerability has been identified in mailcow-dockerized version 2026-03b, specifically within the administrator Queue Manager. This vulnerability arises because the Queue Manager retrieves mail queue entries from the API, transfers server-controlled Postfix queue fields into DataTables rows, and displays several of those fields as HTML without proper output encoding. As a result, an attacker could inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.