mailcow-dockerized, an open source groupware/email suite, suffers from an improper neutralization of input during web page generation (CWE-79) in its Autodiscover logs on the admin dashboard. Specifically, the EMailAddress value logged as the "user" field is not HTML escaped before rendering. An unauthenticated attacker can submit a crafted Autodiscover request with malicious HTML/JavaScript in the EMailAddress, which is stored in Redis and executed when an admin views the logs. This leads to stored cross-site scripting. The vulnerability affects all versions prior to 2026-03b, which contains the fix.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the admin dashboard, potentially leading to session hijacking, credential theft, or other administrative actions. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Upgrade mailcow-dockerized to version 2026-03b or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Until upgrading, restrict access to the admin dashboard and monitor for suspicious Autodiscover requests if possible. Patch status is not explicitly stated but the description confirms version 2026-03b fixes the issue.