CVE-2026-7460 is a stored cross-site scripting vulnerability in mailcow-dockerized 2026-03b affecting the administrator Queue Manager component. The Queue Manager retrieves mail queue entries via the /api/v1/get/mailq/all endpoint and inserts server-controlled Postfix queue fields directly into DataTables rows rendered as HTML without adequate output encoding. This improper neutralization of input (CWE-79) can allow an attacker with limited privileges and user interaction to execute arbitrary scripts in the administrator's browser context. The vulnerability has a CVSS 4.0 score of 7.4, reflecting network attack vector, low attack complexity, partial privileges required, user interaction needed, and high impact on confidentiality and integrity.

Successful exploitation could allow an attacker with limited privileges to inject malicious scripts that execute in the context of the administrator's browser session. This may lead to unauthorized actions or disclosure of sensitive information accessible to the administrator interface. However, exploitation requires user interaction and some privileges, limiting the attack scope. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with mail queue entries and consider restricting access to the Queue Manager interface to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.