---
id: 2444
title: "Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/xss-vulnerabilities-in-mailcow"
published_at: "2026-04-17 00:00"
tags: ["ai-security", "account-takeover", "xss", "cve", "ai-pentesting", "mailcow", "email-server"]
phying_url: "https://phying.com/item/2444"
lang: en
---

# Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow

## Summary

AI pentest agents found three XSS flaws in Mailcow, including one letting unauthenticated attackers hijack admin sessions—assigned CVE-2026-40872, CVE-2026-40873, and CVE-2026-40875.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-04-17 00:00
- **Original:** https://www.aikido.dev/blog/xss-vulnerabilities-in-mailcow
- **Phying News:** https://phying.com/item/2444