mailcow 2025-10 → 2026-05c
9 releases · 0 breaking changes · 8 security fixes · 6 advisories fixed
8security0breaking0deprecated18feature17fix
Vulnerabilities fixed by this upgrade
- 7.0 CVE-2026-40875 Stored XSS in user login history real_rip
- 6.0 CVE-2026-40874 Missing authorization on Forwarding Hosts delete action
- 8.9 CVE-2026-40873 Stored XSS in Quarantine attachment filenames
- 9.3 CVE-2026-40872 Stored XSS in autodiscover logs email address field
- 7.2 CVE-2026-40871 Second Order SQL Injection in quarantine category via API
- 2.1 CVE-2026-40878 Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
Breaking changes
None in the release notes.
Security changes
- security fix unbound CVE-2026-33278 in 2026-05c
- security Fixes CVE-2026-40872: Stored XSS in autodiscover logs email address field in 2026-03b
- security Fixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames in 2026-03b
- security Fixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API in 2026-03b
- security Fixes CVE-2026-40875: Stored XSS in user login history real_rip in 2026-03b
- security Fixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action in 2026-03b
- security Fixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page in 2026-03b
- security Remove deprecated 'X-XSS-Protection' header in 2025-12
Every release in between
other[Nginx] Update to 1.30.2
securityfix unbound CVE-2026-33278
otherUpdate actions/stale action to v10.3.0
otherTranslations update from Weblate
otherUpdate devops-infra/action-pull-request action to v1.1.2
otherUpdate devops-infra/action-pull-request action to v1.1.3
otherUpdate devops-infra/action-pull-request action to v1.2.0
other[Nginx] Update to 1.30.1
otherescape HTML in quarantine table
otherTranslations update from Weblate
featureAdd Uzbek language
otherUpdate devops-infra/action-pull-request action to v1.1.1
other[SOGo] Update to 5.12.8
feature[Web] Add forced 2FA setup and password update enforcement
featureAdd skip feature to mailcow admin password reset script
featurefeat: Implement passwordless autodiscover endpoint
featureacme: add DNS challenges (Documentation)
feature[SOGo] Build SOGo from source with security patches
feature[SOGo] Update to 5.12.5
feature[Rspamd] Update to 3.14.3-1
fixFix lua script sub-addressing
fixDocument qitem endpoint in openapi.yaml for editing quarantine mails
fixcheck_dns: better time measurement
fixfix: show stopped and failed containers in dashboard and API
fixBump alpine version of netfilter
fix[Web] Add missing EAS and DAV protocol options to mailbox bulk actions
fix[Web] switch from GET to POST for datatable requests
fix[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
otherUpdate actions/stale action to v10.2.0
otherUpdate docker/build-push-action action to v7
otherchore(deps): update dependency composer/composer to v2.9.5
otherchore(deps): update docker/setup-qemu-action action to v4
otherchore(deps): update docker/login-action action to v4
otherchore(deps): update docker/setup-buildx-action action to v4
securityFixes CVE-2026-40872: Stored XSS in autodiscover logs email address field
securityFixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames
securityFixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API
securityFixes CVE-2026-40875: Stored XSS in user login history real_rip
securityFixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action
securityFixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
other[Web][Dovecot] Improve input validation and escaping
other[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes
other[ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME
fixFix theme localStorage collision with rspamd UI
otherTranslations update from Weblate
other[ACME] Skip autodiscover/mta-sts subdomains covered by wildcard certificates
featureSupport for PBKDF2-SHA512 hash algorithm in verify_hash() (FreeIPA compatibility) (issue 6646)
featurerspamd: upgrade to 3.14.1, trixie rebuild + bcc forwarded hosts fix
featureAdd MTA-STS support for alias domains
featureConfigurable displayName(s) - Fixes issue #6489
feature[Web] Disable login UI on autoprotocol domains
feature[Web] Allow admins to limit EAS and DAV access for mailbox users
featurefeat: allow preset of passwords via environment vars
feature[Postfix] Configurable send permissions for alias addresses
fixui: fix global filters ui tickbox reappearing
fixPrevent duplicate/plaintext login announcement rendering
fixfix: Password for mobileconfig that conforms to password-complexity policy
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherchore(deps): update peter-evans/create-pull-request action to v8
otherchore(deps): update dependency krakjoe/apcu to v5.1.28
otherchore(deps): update dependency imagick/imagick to v3.8.1
otherchore(deps): update dependency phpredis/phpredis to v6.3.0
otherchore(deps): update dependency php-memcached-dev/php-memcached to v3.4.0
otherchore(deps): update dependency tianon/gosu to v1.19
otherchore(deps): update devops-infra/action-pull-request action to v1
otherchore(deps): update devops-infra/action-pull-request action to v1.0.2
featureAdd Vietnamese language
otherchore(deps): update alpine docker tag to v3.22
otherTranslations update from Weblate
otherDisable PHP opcache.jit
otherUpdate 2025-10a Hotfix
other[Web] Correct order of Dansk/Danish in UI
other[Postfix] update postscreen_access.cidr
otherReplace pigz with zstd for backup compression
othercompose: changes cronjobs to regular cron syntax + fixed sogo creds for cronjobs
otherUpdate backup container to trixie
securityRemove deprecated 'X-XSS-Protection' header
otherHide nginx version in http context for all sites
featureAllow making spam aliases permanent
otherchore(deps): update actions/checkout action to v6
otherchore(deps): update actions/stale action to v10.1.1
otherchore(deps): update alpine docker tag to v3.23
fixfix(api): add missing break in CORS switch block causing save to hang
otherpf-tlspol: upgrade to 1.8.22
fixPrevent duplicate/plaintext login announcement rendering in c11ed5dd1e899173500161ebf52e572de42917ca
fixofelia: revert fixed cron syntax for sa-rules download by @DerLinkman in e76f5237edcccd8fdcc613e22f9d9b84265459db
fixbackup: add image prefetch function to verify latest image is used by @DerLinkman in d977ddb5017e27f817f09310dcb7056449cb88fd
fixSupport for PBKDF2-SHA512 hash algorithm in verify_hash() (FreeIPA compatibility) by @Ashitaka57 in e8d9315d4ad6ae886b8146f618df1813db546254