A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot.

The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. Mailcow is a dockerized email package, with multiple containers linked in one bridged network. Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the 'Regenerate Invite Id' API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. Users unable to upgrade may disable the custom reset URL allow list as a workaround. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list. The problem has been resolved and released under version 9.23.0. An attacker could exploit this to email users urls to the servers domain but which may contain malicious code. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. Directus is a real-time API and App dashboard for managing SQL database content.

Proton email read receipt