Vulnerability Description
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-40874?
CVE-2026-40874 is a documented vulnerability. mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delet...
How severe is CVE-2026-40874?
CVSS scoring is not yet available for CVE-2026-40874. Check NVD for updates.
Is there a patch for CVE-2026-40874?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.