CVE-2026-40874: mailcow dockerized Auth Bypass Vulnerability

CVE-2026-40874 Overview

CVE-2026-40874 is an Authorization Bypass vulnerability in mailcow: dockerized, an open source groupware/email suite based on Docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with the /api/v1/delete/fwdhost API endpoint. Any authenticated user can call this API, regardless of their privilege level. While access control checks are applied for edit and add actions, the deletion endpoint lacks proper authorization validation, which can significantly disrupt mail service operations.

Critical Impact

Any authenticated user can delete Forwarding Hosts via the unprotected API endpoint, potentially causing significant mail service disruption and denial of service conditions.

Affected Products

• mailcow: dockerized versions prior to 2026-03b

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40874 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40874

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating that the application fails to properly restrict access to a critical administrative function. The vulnerable endpoint /api/v1/delete/fwdhost is responsible for removing Forwarding Hosts from the mailcow configuration.

The vulnerability requires network access and low-privilege authentication to exploit. The attack complexity is high due to prerequisite conditions that must be met, but successful exploitation can result in high availability impact. There is no direct confidentiality or integrity impact, as the vulnerability specifically affects service availability through unauthorized deletion of mail forwarding configurations.

Root Cause

The root cause of this vulnerability lies in inconsistent access control implementation across the mailcow API. While the development team properly implemented administrator verification for edit and add operations on Forwarding Hosts, the deletion endpoint was left unprotected. This oversight allows any user with valid authentication credentials to invoke the delete operation, bypassing the intended administrative privilege requirements.

Attack Vector

The attack vector is network-based, requiring the attacker to have valid low-privilege credentials for the mailcow system. An attacker can exploit this vulnerability by sending authenticated API requests to the /api/v1/delete/fwdhost endpoint.

The deletion of Forwarding Hosts can disrupt legitimate mail routing configurations, potentially causing email delivery failures, bounced messages, or complete mail service disruption for affected domains. This represents a denial of service condition that could impact business operations dependent on the email infrastructure.

For additional technical details, refer to the GitHub Mailcow Security Advisory.

Detection Methods for CVE-2026-40874

Indicators of Compromise

• Unexpected API calls to /api/v1/delete/fwdhost from non-administrative user accounts
• Sudden removal of Forwarding Host configurations without corresponding administrative actions
• Audit log entries showing deletion operations performed by users without administrator privileges
• Mail delivery failures or bounced emails indicating disrupted forwarding configurations

Detection Strategies

• Monitor API access logs for requests to the /api/v1/delete/fwdhost endpoint, correlating with user privilege levels
• Implement alerting on Forwarding Host configuration changes, especially deletions
• Review authentication logs for patterns of API access from low-privilege accounts to administrative endpoints
• Deploy web application firewall rules to flag suspicious API deletion requests

Monitoring Recommendations

• Enable detailed API request logging for all administrative endpoints in mailcow
• Configure alerts for any changes to Forwarding Host configurations
• Establish baseline patterns of normal API usage to identify anomalous deletion activity
• Integrate mailcow logs with SIEM solutions for centralized monitoring and correlation

How to Mitigate CVE-2026-40874

Immediate Actions Required

• Upgrade mailcow: dockerized to version 2026-03b or later immediately
• Review API access logs for evidence of unauthorized Forwarding Host deletions
• Audit current Forwarding Host configurations to identify any unauthorized changes
• Restrict API access to trusted networks or administrators until patching is complete

Patch Information

The vulnerability has been fixed in mailcow: dockerized version 2026-03b. This patch adds proper administrator verification to the /api/v1/delete/fwdhost endpoint, ensuring that only users with administrative privileges can delete Forwarding Host configurations. Organizations should update to this version or later to remediate the vulnerability.

For patch details and upgrade instructions, see the GitHub Mailcow Security Advisory.

Workarounds

• Implement network-level access controls to restrict API endpoint access to trusted administrator IP addresses
• Deploy a reverse proxy with authentication rules to enforce additional authorization checks on the vulnerable endpoint
• Temporarily disable or restrict access to the /api/v1/delete/fwdhost endpoint until the patch can be applied
• Monitor and audit all API requests to detect and respond to unauthorized deletion attempts

# Example: Restrict API access via reverse proxy configuration
# Add to your reverse proxy configuration to limit access to the vulnerable endpoint
# This example uses nginx - adjust for your specific reverse proxy

location /api/v1/delete/fwdhost {
    # Allow only from trusted admin IP ranges
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Proxy to mailcow backend
    proxy_pass http://mailcow-backend;
}