CVE-2023-26490

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

mailcow is a dockerized email package that links multiple containers in a single bridged network. The Sync Job feature, which can be enabled for standard users via an ACL, contains a command injection vulnerability (CWE-78) in the imapsync Perl script. When constructing a shell command that invokes openssl for XOAUTH2 authentication, portions of the user-supplied password are incorporated without validation, allowing arbitrary command execution inside the dovecot container.

An attacker who obtains the Sync Job permission can exploit the flaw to gain shell access within the affected container. The permission is not granted by default to newly created mailcow accounts, limiting exposure to users who have been explicitly assigned the ACL or to accounts created before the default policy was enforced.

The vulnerability was addressed in the 2023-03 mailcow release published on 3 March 2023. As an interim mitigation, administrators can remove the Syncjob ACL from all mailbox users to prevent creation or modification of sync jobs. The corresponding GitHub Security Advisory and release notes document the fix and the workaround.