mailcow 2026-03a → 2026-11
13 releases · 3 breaking changes · 19 security fixes · 6 advisories fixed
19security3breaking0deprecated32feature24fix
Vulnerabilities fixed by this upgrade
- 7.0 CVE-2026-40875 Stored XSS in user login history real_rip
- 6.0 CVE-2026-40874 Missing authorization on Forwarding Hosts delete action
- 8.9 CVE-2026-40873 Stored XSS in Quarantine attachment filenames
- 9.3 CVE-2026-40872 Stored XSS in autodiscover logs email address field
- 7.2 CVE-2026-40871 Second Order SQL Injection in quarantine category via API
- 2.1 CVE-2026-40878 Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
Breaking changes
- breaking Sync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or… in 2026-11
- breaking Request body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above… in 2026-11
- breaking Custom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on… in 2026-11
Security changes
- security SOGo 5.12.13, an upstream security release (notes) in 2026-11
- security Several security fixes in mailcow (details next week) in 2026-11
- security Fail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit in 2026-11
- security Fixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening in 2026-11
- security [SOGo] Update to 5.12.13 in 2026-11
- security [PHP] Update base to Alpine 3.24, build PECL extensions from GitHub in 2026-10
- security [SOGo] Update to 5.12.12 in 2026-10
- security [Nginx] Update to 1.30.6 in 2026-10
- security [Rspamd] update to 4.1.4 in 2026-07a
- security Fix nginx CVE-2026-42533 in 2026-07a
- security Update actions/stale action to v11 in 2026-07a
- security Hardening mailcow in 2026-07a
- security fix unbound CVE-2026-33278 in 2026-05c
- security Fixes CVE-2026-40872: Stored XSS in autodiscover logs email address field in 2026-03b
- security Fixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames in 2026-03b
- security Fixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API in 2026-03b
- security Fixes CVE-2026-40875: Stored XSS in user login history real_rip in 2026-03b
- security Fixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action in 2026-03b
- security Fixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page in 2026-03b
Every release in between
breakingSync job API: add/syncjob needs a source_id, and the server fields (host1, port1, enc1, authmech1) are no longer accepted or returned. Existing jobs are migrated automatically. Action: If you create or read sync jobs through the API, update your client. Create a source with add/syncjob_source (or…
breakingRequest body limit: 64 MB for UI/API, NGINX_MAX_BODY_SIZE (default 128m) for SOGo/EAS/DAV. If it is below your Postfix message_size_limit, large mails can't be sent via SOGo webmail or ActiveSync. Action: If you raised the Postfix message size limit, set NGINX_MAX_BODY_SIZE in mailcow.conf above…
breakingCustom nginx locations (data/conf/nginx/site..custom): they are now limited to 64 MB as well, before there was no limit. Apps you run under the mailcow host this way (e.g. Nextcloud or Gitea under a path) reject larger uploads with 413. Own server blocks in data/conf/nginx/.conf (e.g. Nextcloud on…
securitySOGo 5.12.13, an upstream security release (notes)
securitySeveral security fixes in mailcow (details next week)
securityFail2ban counts failed logins of all protocols (IMAP, POP3, SMTP, Sieve, EAS, DAV), 2FA rate limit
featureGroups with their own address work as distribution lists. Members can come from all domains you manage.
featureMembers can send as the group address and as other addresses of the group.
featureShare mailboxes with a group (IMAP, shown as Shared/), as well as SOGo calendars and address books. Members can be subscribed automatically.
featureShared mailboxes have no login of their own and are accessed through groups.
featureMailbox templates can be assigned per group, with a priority.
featureDomain admins manage the groups of their domains (new ACL "Mailbox groups").
featureGroups from the IdP are synced to mailcow groups, including their members.
featureOptional offboarding: if a user is disabled or deleted in the IdP, the mailbox login is disabled, but mail is still delivered. Off by default.
featureThe admin UI shows the sync status, conflicts and a preview.
featureSync sources: the server settings (host, port, encryption, authentication) are defined once and used by any number of jobs. A source can be available to everyone, to specific domains or to single users. Presets cover common providers.
featureOAuth2 (XOAUTH2) for Microsoft 365 and Google. Tokens are refreshed automatically, even while a job is running.
featureParallel jobs: several jobs run at the same time. The maximum and a bandwidth limit can be set in the admin UI.
featureThe certificate of the source server is verified (SSL and STARTTLS). The check can be turned off per source.
featureUpdated to imapsync 2.314.
featureAny number of API keys, each with a description, read-only or read-write access and its own IP allowlist.
featureKeys from mailcow.conf are shown as locked service keys.
feature[Web][Dovecot] Rework imapsync: sync sources, OAuth2, Python runner
feature[Web] Rework API keys: multiple keys + locked service keys from mailcow.conf
feature[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync
feature[Netfilter] Rework: robust bans, no restart loops, identity provider outages are no failed logins
feature[Web] Add Netfilter unban all button
securityFixes for the reworks: imapsync, logins/netfilter, groups, startup, hardening
security[SOGo] Update to 5.12.13
otherUpdate Alpine Images to 3.24
other[Rspamd] Update to 4.2.3
other[ACME][Dockerapi][Dovecot][Olefy][PHP][Rspamd][SOGo][Unbound][Watchdog] Update image tags
other[Web] Update composer libraries
otherUpdate redis Docker tag to v7.4.12
otherUpdate dependency tianon/gosu to v1.20
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
security[PHP] Update base to Alpine 3.24, build PECL extensions from GitHub
security[SOGo] Update to 5.12.12
security[Nginx] Update to 1.30.6
featureFeat/update UI
otherTranslations update from Weblate
feature[Web] Add ACL + global switch to disable external alias goto
feature[Web] Add show/hide password toggle on login pages
fixFix #7150: passwd-verify.lua wipes auth cache during any nginx outage
fix[Web] use absolute RHS names in generated DNS zonefile
fix[Web] redirect deep links to the matching login page
fix[Web] show external sender addresses regardless of authsource
fix[Web] translate password errors in the forced password change modal
other[Unbound] Update to 1.26.1
other[SOGo] Update to 5.12.11
otherUpdate redis Docker tag to v7.4.11
otherpostfix-tlspol: upgrade to trixie + 1.11.0 update
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
other[postfix-tlspol] bump to v1.14.0
other[Rspamd] Update to 4.2.1
fixFixed typo (changing RESOVLER to RESOLVER).
other[Postfix] update postscreen_access.cidr
otherUpdate RSPAMD version to 4.1.0 in Dockerfile
other[Rspamd] Migrate metadata_exporter to multipart formatter
otherRefresh SOGo view after mailbox activation
fixFix force_tfa not available in mailbox template #7216
other[SOGo] Update to 5.12.9
otherEscape generated password in mobileconfig
other[Nignx] Update to 1.30.3
otherpostfix: migrate from bookworm to trixie
otherUpdate dependency composer/composer to v2.10.2
otherUpdate devops-infra/action-pull-request action to v1.2.1
otherUpdate actions/stale action to v10.4.0
otherUpdate devops-infra/action-pull-request action to v1.4.0
otherUpdate dependency php/pecl-mail-mailparse to v3.2.0
otherUpdate dependency composer/composer to v2.10.1
otherUpdate alpine Docker tag to v3.24
otherUpdate actions/checkout action to v7
otherUpdate devops-infra/action-pull-request action to v1.3.0
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
otherui, fail2ban fix german ban_list_info translation
otherRefined wording for displaying of active settings on quarantine page.
other[Redis] Update to 7.4.10
other[Clamd] Update to 1.4.6
other[SOGo] Update to 5.12.10
other[Web] Minor hardening across web UI and nginx
other[Dovecot] Remove legacy DeltaChat auto-filing sieve rule
other[Postfix] update postscreen_access.cidr
otherupdate README.md sponsors
otherTranslations update from Weblate
security[Rspamd] update to 4.1.4
securityFix nginx CVE-2026-42533
securityUpdate actions/stale action to v11
securityHardening mailcow
fixfix: restore subject display in quarantine overview
fix[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set
fix[Web] fix add/time_limited_alias silently discarding requests and validity
fix[Web] return sender_acl in get/mailbox API
fixfix: cors allowed origins settings validation
fix[Web] harden CORS origin matching and add Vary: Origin
fix[Web] Move mailcow update check to server side
fix[Web] Create default mailbox template with eas and dav access
fix[ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain
other[Postfix] update postscreen_access.cidr
otherTranslations update from Weblate
other[Web] escape HTML in sieve filter edit view and queue manager
other[Nginx] Update to 1.30.2
securityfix unbound CVE-2026-33278
otherUpdate actions/stale action to v10.3.0
otherTranslations update from Weblate
otherUpdate devops-infra/action-pull-request action to v1.1.2
otherUpdate devops-infra/action-pull-request action to v1.1.3
otherUpdate devops-infra/action-pull-request action to v1.2.0
other[Nginx] Update to 1.30.1
otherescape HTML in quarantine table
otherTranslations update from Weblate
featureAdd Uzbek language
otherUpdate devops-infra/action-pull-request action to v1.1.1
other[SOGo] Update to 5.12.8
feature[Web] Add forced 2FA setup and password update enforcement
featureAdd skip feature to mailcow admin password reset script
featurefeat: Implement passwordless autodiscover endpoint
featureacme: add DNS challenges (Documentation)
feature[SOGo] Build SOGo from source with security patches
feature[SOGo] Update to 5.12.5
feature[Rspamd] Update to 3.14.3-1
fixFix lua script sub-addressing
fixDocument qitem endpoint in openapi.yaml for editing quarantine mails
fixcheck_dns: better time measurement
fixfix: show stopped and failed containers in dashboard and API
fixBump alpine version of netfilter
fix[Web] Add missing EAS and DAV protocol options to mailbox bulk actions
fix[Web] switch from GET to POST for datatable requests
fix[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
otherTranslations update from Weblate
other[Postfix] update postscreen_access.cidr
otherUpdate actions/stale action to v10.2.0
otherUpdate docker/build-push-action action to v7
otherchore(deps): update dependency composer/composer to v2.9.5
otherchore(deps): update docker/setup-qemu-action action to v4
otherchore(deps): update docker/login-action action to v4
otherchore(deps): update docker/setup-buildx-action action to v4
securityFixes CVE-2026-40872: Stored XSS in autodiscover logs email address field
securityFixes CVE-2026-40873: Stored XSS in Quarantine attachment filenames
securityFixes CVE-2026-40871: Second Order SQL Injection in quarantine category via API
securityFixes CVE-2026-40875: Stored XSS in user login history real_rip
securityFixes CVE-2026-40874: Missing authorization on Forwarding Hosts delete action
securityFixes CVE-2026-40878: Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page
other[Web][Dovecot] Improve input validation and escaping