mailcow: dockerized vulnerable to password reset poisoning

published 2025-02-12 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-4084

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 1; Exploit-DB

mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.

Patch / fix

fixed in 1

mailcow mailcow:_dockerized 2025-01a

Timeline

2025-02-12 Published
2026-03-03 First public exploit (EDB-52485)

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 20 mo ago (2025-02-12)

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-52485 mailcow 2025-01a - Host Header Password Reset Poisoning webapps, 2026-03-03

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

mailcow mailcow-dockerized

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

github.com /mailcow/mailcow-dockerized/security/advisories/GHSA-3mvx-qw4r-fcqf
vendor-advisory

Sources

CVE List CVE-2025-25198
NVD CVE-2025-25198

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary