CVE-2023-26490

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. Notably, the default ACL for a newly-created mailcow account does not include the necessary permission. The Issue has been fixed within the 2023-03 Update (March 3rd 2023). As a temporary workaround the Syncjob ACL can be removed from all mailbox users, preventing from creating or changing existing Syncjobs.

• CWE-78

• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03Release Notes
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7Exploit, Third Party Advisory
• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03Release Notes
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7Exploit, Third Party Advisory

Published

Mar 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26485cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-26486Vega is a visualization grammar, a declarative format for cr…6.1
• CVE-2023-26487Vega is a visualization grammar, a declarative format for cr…6.1
• CVE-2023-26488OpenZeppelin Contracts is a library for secure smart contrac…6.5
• CVE-2023-26489wasmtime is a fast and secure runtime for WebAssembly. In af…9.9
• CVE-2023-2649A vulnerability was found in Tenda AC23 16.03.07.45_cn. It h…8.8
• CVE-2023-26491RSSHub is an open source and extensible RSS feed generator. …6.1
• CVE-2023-26492Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2023-26493Cocos Engine is an open-source framework for building 2D & 3…8.8
• CVE-2023-26494lorawan-stack is an open source LoRaWAN network server. Prio…6.1
• CVE-2023-26495An issue was discovered in Open Design Alliance Drawings SDK…7.8
• CVE-2023-26496An issue was discovered in Samsung Baseband Modem Chipset fo…9.8