mailcow 2025-09 → 2026-10
18 releases · 0 breaking changes · 15 security fixes · 6 advisories fixed
15security0breaking0deprecated23feature34fix
Vulnerabilities fixed by this upgrade
- 7.0 CVE-2026-40875 Stored XSS in user login history real_rip
- 6.0 CVE-2026-40874 Missing authorization on Forwarding Hosts delete action
- 8.9 CVE-2026-40873 Stored XSS in Quarantine attachment filenames
- 9.3 CVE-2026-40872 Stored XSS in autodiscover logs email address field
- 7.2 CVE-2026-40871 Second Order SQL Injection in quarantine category via API
- 2.1 CVE-2026-40878 Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
Breaking changes
None in the release notes.
Security changes
- security [PHP] Update base to Alpine 3.24, build PECL extensions from GitHub in 2026-10
- security [SOGo] Update to 5.12.12 in 2026-10
- security [Nginx] Update to 1.30.6 in 2026-10
- security [Rspamd] update to 4.1.4 in 2026-07a
- security Fix nginx CVE-2026-42533 in 2026-07a
- security Update actions/stale action to v11 in 2026-07a
- security Hardening mailcow in 2026-07a
- security fix unbound CVE-2026-33278 in 2026-05c
- security Fixes CVE-2026-40872: Stored XSS in autodiscover logs email address field in 2026-03b
- security Fixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames in 2026-03b
- security Fixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API in 2026-03b
- security Fixes CVE-2026-40875: Stored XSS in user login history real_rip in 2026-03b
- security Fixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action in 2026-03b
- security Fixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page in 2026-03b
- security Remove deprecated 'X-XSS-Protection' header in 2025-12
Every release in between
security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub
security[SOGo] Update to 5.12.12
security[Nginx] Update to 1.30.6
featureFeat/update UI
otherTranslations update from Weblate
feature[Web] Add ACL + global switch to disable external alias goto
feature[Web] Add show/hide password toggle on login pages
fixFix #7150: passwd-verify.lua wipes auth cache during any nginx outage
fix[Web] use absolute RHS names in generated DNS zonefile
fix[Web] redirect deep links to the matching login page
fix[Web] show external sender addresses regardless of authsource
fix[Web] translate password errors in the forced password change modal
other[Unbound] Update to 1.26.1
other[SOGo] Update to 5.12.11
otherUpdate redis Docker tag to v7.4.11
otherpostfix-tlspol: upgrade to trixie + 1.11.0 update
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
other[postfix-tlspol] bump to v1.14.0
other[Rspamd] Update to 4.2.1
fixFixed typo (changing RESOVLER to RESOLVER).
other[Postfix] update postscreen_access.cidr
otherUpdate RSPAMD version to 4.1.0 in Dockerfile
other[Rspamd] Migrate metadata_exporter to multipart formatter
otherRefresh SOGo view after mailbox activation
fixFix force_tfa not available in mailbox template #7216
other[SOGo] Update to 5.12.9
otherEscape generated password in mobileconfig
other[Nignx] Update to 1.30.3
otherpostfix: migrate from bookworm to trixie
otherUpdate dependency composer/composer to v2.10.2
otherUpdate devops-infra/action-pull-request action to v1.2.1
otherUpdate actions/stale action to v10.4.0
otherUpdate devops-infra/action-pull-request action to v1.4.0
otherUpdate dependency php/pecl-mail-mailparse to v3.2.0
otherUpdate dependency composer/composer to v2.10.1
otherUpdate alpine Docker tag to v3.24
otherUpdate actions/checkout action to v7
otherUpdate devops-infra/action-pull-request action to v1.3.0
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherui, fail2ban fix german ban_list_info translation
otherRefined wording for displaying of active settings on quarantine page.
other[Redis] Update to 7.4.10
other[Clamd] Update to 1.4.6
other[SOGo] Update to 5.12.10
other[Web] Minor hardening across web UI and nginx
other[Dovecot] Remove legacy DeltaChat auto-filing sieve rule
other[Postfix] update postscreen_access.cidr
otherupdate README.md sponsors
otherTranslations update from Weblate
security[Rspamd] update to 4.1.4
securityFix nginx CVE-2026-42533
securityUpdate actions/stale action to v11
securityHardening mailcow
fixfix: restore subject display in quarantine overview
fix[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set
fix[Web] fix add/time_limited_alias silently discarding requests and validity
fix[Web] return sender_acl in get/mailbox API
fixfix: cors allowed origins settings validation
fix[Web] harden CORS origin matching and add Vary: Origin
fix[Web] Move mailcow update check to server side
fix[Web] Create default mailbox template with eas and dav access
fix[ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
other[Web] escape HTML in sieve filter edit view and queue manager
other[Nginx] Update to 1.30.2
securityfix unbound CVE-2026-33278
otherUpdate actions/stale action to v10.3.0
otherTranslations update from Weblate
otherUpdate devops-infra/action-pull-request action to v1.1.2
otherUpdate devops-infra/action-pull-request action to v1.1.3
otherUpdate devops-infra/action-pull-request action to v1.2.0
other[Nginx] Update to 1.30.1
otherescape HTML in quarantine table
otherTranslations update from Weblate
featureAdd Uzbek language
otherUpdate devops-infra/action-pull-request action to v1.1.1
other[SOGo] Update to 5.12.8
feature[Web] Add forced 2FA setup and password update enforcement
featureAdd skip feature to mailcow admin password reset script
featurefeat: Implement passwordless autodiscover endpoint
featureacme: add DNS challenges (Documentation)
feature[SOGo] Build SOGo from source with security patches
feature[SOGo] Update to 5.12.5
feature[Rspamd] Update to 3.14.3-1
fixFix lua script sub-addressing
fixDocument qitem endpoint in openapi.yaml for editing quarantine mails
fixcheck_dns: better time measurement
fixfix: show stopped and failed containers in dashboard and API
fixBump alpine version of netfilter
fix[Web] Add missing EAS and DAV protocol options to mailbox bulk actions
fix[Web] switch from GET to POST for datatable requests
fix[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
otherUpdate actions/stale action to v10.2.0
otherUpdate docker/build-push-action action to v7
otherchore(deps): update dependency composer/composer to v2.9.5
otherchore(deps): update docker/setup-qemu-action action to v4
otherchore(deps): update docker/login-action action to v4
otherchore(deps): update docker/setup-buildx-action action to v4
securityFixes CVE-2026-40872: Stored XSS in autodiscover logs email address field
securityFixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames
securityFixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API
securityFixes CVE-2026-40875: Stored XSS in user login history real_rip
securityFixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action
securityFixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
other[Web][Dovecot] Improve input validation and escaping
other[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes
other[ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME
fixFix theme localStorage collision with rspamd UI
otherTranslations update from Weblate
other[ACME] Skip autodiscover/mta-sts subdomains covered by wildcard certificates
featureSupport for PBKDF2-SHA512 hash algorithm in verify_hash() (FreeIPA compatibility) (issue 6646)
featurerspamd: upgrade to 3.14.1, trixie rebuild + bcc forwarded hosts fix
featureAdd MTA-STS support for alias domains
featureConfigurable displayName(s) - Fixes issue #6489
feature[Web] Disable login UI on autoprotocol domains
feature[Web] Allow admins to limit EAS and DAV access for mailbox users
featurefeat: allow preset of passwords via environment vars
feature[Postfix] Configurable send permissions for alias addresses
fixui: fix global filters ui tickbox reappearing
fixPrevent duplicate/plaintext login announcement rendering
fixfix: Password for mobileconfig that conforms to password-complexity policy
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherchore(deps): update peter-evans/create-pull-request action to v8
otherchore(deps): update dependency krakjoe/apcu to v5.1.28
otherchore(deps): update dependency imagick/imagick to v3.8.1
otherchore(deps): update dependency phpredis/phpredis to v6.3.0
otherchore(deps): update dependency php-memcached-dev/php-memcached to v3.4.0
otherchore(deps): update dependency tianon/gosu to v1.19
otherchore(deps): update devops-infra/action-pull-request action to v1
otherchore(deps): update devops-infra/action-pull-request action to v1.0.2
featureAdd Vietnamese language
otherchore(deps): update alpine docker tag to v3.22
otherTranslations update from Weblate
otherDisable PHP opcache.jit
otherUpdate 2025-10a Hotfix
other[Web] Correct order of Dansk/Danish in UI
other[Postfix] update postscreen_access.cidr
otherReplace pigz with zstd for backup compression
othercompose: changes cronjobs to regular cron syntax + fixed sogo creds for cronjobs
otherUpdate backup container to trixie
securityRemove deprecated 'X-XSS-Protection' header
otherHide nginx version in http context for all sites
featureAllow making spam aliases permanent
otherchore(deps): update actions/checkout action to v6
otherchore(deps): update actions/stale action to v10.1.1
otherchore(deps): update alpine docker tag to v3.23
fixfix(api): add missing break in CORS switch block causing save to hang
otherpf-tlspol: upgrade to 1.8.22
fixPrevent duplicate/plaintext login announcement rendering in c11ed5dd1e899173500161ebf52e572de42917ca
fixofelia: revert fixed cron syntax for sa-rules download by @DerLinkman in e76f5237edcccd8fdcc613e22f9d9b84265459db
fixbackup: add image prefetch function to verify latest image is used by @DerLinkman in d977ddb5017e27f817f09310dcb7056449cb88fd
fixSupport for PBKDF2-SHA512 hash algorithm in verify_hash() (FreeIPA compatibility) by @Ashitaka57 in e8d9315d4ad6ae886b8146f618df1813db546254
other[Redis] Update to Redis 7.4.6
other[Rspamd] Update to 3.13.2
fixfix autodiscover when using ldap with attribute mapping templates
other[Web] Fix SOGo redirection after login
otherShow app passwords for successful logins on user page
otherOptimize phpfpm opcache: more aggressive caching, enable JIT
feature[Web] Add password verification when setting recovery email
otherchore(deps): update dependency php/pecl-mail-mailparse to v3.1.9
otherchore(deps): update dependency krakjoe/apcu to v5.1.27
otherUpdate pt-br lang
otherTranslations update from Weblate
otherDisable PHP opcache.jit
featureAdd Vietnamese language
otherTranslations update from Weblate
otherchore(deps): update devops-infra/action-pull-request action to v1
otherchore(deps): update devops-infra/action-pull-request action to v1.0.2
otherchore(deps): update alpine docker tag to v3.22