Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in mailcow: dockerized allows an unauthenticated attacker to execute code by submitting a specially crafted Autodiscover request. The attack exploits a failure to properly escape HTML/JavaScript in logged email addresses, which is then executed when an administrator views the logs. This could lead to a compromise of the email server.
- Unauthenticated access to a core service.
- Execution of arbitrary code on the server.
- Affects email and groupware services.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this by sending a specially crafted Autodiscover request to the mailcow instance. The crafted request, containing HTML and JavaScript in the EMailAddress field, will be stored. When an administrator later views the Autodiscover logs, the embedded script will execute within their browser, potentially allowing the attacker to take control of the administrator's session.
- Target: Admin Autodiscover logs.
- Vulnerable Action: Autodiscover request submission.
- Precondition: Admin views logs.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could be attractive to attackers due to its ability to execute arbitrary JavaScript in the context of an admin user, potentially leading to account takeover or further compromise of the mailcow instance. The unauthenticated nature and direct execution upon log viewing present a compelling attack vector.
- Public exploit code exists.
- Exploitation observed in the wild.
- Recency signal is strong.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching affected mailcow installations immediately, as unauthenticated users can execute arbitrary JavaScript in an admin's browser by manipulating Autodiscover logs. If patching is delayed, restrict network access to the Autodiscover endpoint and monitor logs for suspicious requests targeting the user field.
- Apply version 2026-03b or later.
- Block Autodiscover network access.
- Log and alert on Autodiscover requests.
