mailcow-dockerized versions before 2026-03b have an XSS vulnerability (CWE-79) in the user dashboard's login history feature. The client IP is taken from the X-Real-IP header and rendered without HTML escaping, allowing injection of HTML/JS code. This vulnerability can be exploited via self-XSS combined with login CSRF to hijack session context and read emails. The vulnerability is addressed in version 2026-03b. The CVSS 4.0 score is 7.0 (high), reflecting network attack vector, high complexity, partial user interaction, and high impact on confidentiality.

Successful exploitation allows an attacker to inject malicious scripts into the login history page by manipulating the X-Real-IP header. This can be leveraged with a login CSRF attack to force a victim to log into the attacker's account, enabling the attacker to read the victim's emails in a different browser tab. The vulnerability impacts confidentiality and user session integrity. There are no known exploits in the wild as of the published date.

Upgrade mailcow-dockerized to version 2026-03b or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official release notes. Until upgraded, be cautious of login CSRF attacks and untrusted X-Real-IP headers. Patch status is not explicitly confirmed beyond the version fix mention; check vendor sources for current remediation guidance.