Version 75 (April 20, 2026)

* Updated Roundcube to 1.6.15, fixing a security vulnerability.
* Fixed error when configuring S3 backups on empty buckets.
* Fixed issue in management daemon name resolution.
* Fixed accessibility issues in the control panel.

CHANGELOG.md

@@ -1,6 +1,14 @@
 CHANGELOG
 =========
 
+Version 75 (April 20, 2026)
+---------------------------
+
+* Updated Roundcube to 1.6.15, fixing a security vulnerability.
+* Fixed error when configuring S3 backups on empty buckets.
+* Fixed issue in management daemon name resolution.
+* Fixed accessibility issues in the control panel.
+
 Version 74 (January 4, 2026)
 ----------------------------
 

management/backup.py

@@ -505,12 +505,10 @@ def list_target_files(config):
 		from botocore.exceptions import ClientError
 
 		# separate bucket from path in target
-		bucket = target.path[1:].split('/')[0]
+		bucket_path = target.path.lstrip('/')
-		path = '/'.join(target.path[1:].split('/')[1:]) + '/'
+		bucket, _, path = bucket_path.partition('/')
-
+		if path and not path.endswith('/'):
-		# If no prefix is specified, set the path to '', otherwise boto won't list the files
+			path += '/'
-		if path == '/':
-			path = ''
 
 		if bucket == "":
 			msg = "Enter an S3 bucket name."
@@ -525,7 +523,8 @@ def list_target_files(config):
 					endpoint_url=f'https://{target.hostname}', \
 					aws_access_key_id=config['target_user'], \
 					aws_secret_access_key=config['target_pass'])
-			bucket_objects = s3.list_objects_v2(Bucket=bucket, Prefix=path)['Contents']
+			response = s3.list_objects_v2(Bucket=bucket, Prefix=path)
+			bucket_objects = response.get('Contents', [])
 			backup_list = [(key['Key'][len(path):], key['Size']) for key in bucket_objects]
 		except ClientError as e:
 			raise ValueError(e)

management/templates/aliases.html

@@ -45,21 +45,40 @@
       </div>
     </div>
   </div>
-  <div class="form-group">
+<div class="form-group">
+  <fieldset>
+    <legend>
     <label for="addaliasSenders" class="col-sm-1 control-label">Permitted Senders</label>
+    </legend>
+
     <div class="col-sm-10">
       <div class="radio">
-        <label>
+        <label for="addaliasForwardsToNotAdvanced">
-          <input id="addaliasForwardsToNotAdvanced" name="addaliasForwardsToDivToggle" type="radio" checked onclick="$('#addaliasForwardsToDiv').toggle(false)">
+          <input id="addaliasForwardsToNotAdvanced"
-          Any mail user listed in the Forwards To box can send mail claiming to be from <span class="regularalias">the alias address</span><span class="catchall domainalias">any address on the alias domain</span>.
+                 name="addaliasForwardsToDivToggle"
+                 type="radio"
+                 checked
+                 onclick="$('#addaliasForwardsToDiv').toggle(false)">
+          Any mail user listed in the Forwards To box can send mail claiming to be from
+          <span class="regularalias">the alias address</span>
+          <span class="catchall domainalias">any address on the alias domain</span>.
         </label>
       </div>
+
       <div class="radio">
-        <label>
+        <label for="addaliasForwardsToAdvanced">
-          <input id="addaliasForwardsToAdvanced" name="addaliasForwardsToDivToggle" type="radio" id="addaliasForwardsToDivShower" onclick="$('#addaliasForwardsToDiv').toggle(true)">
+          <input id="addaliasForwardsToAdvanced"
-          I&rsquo;ll enter the mail users that can send mail claiming to be from <span class="regularalias">the alias address</span><span class="catchall domainalias">any address on the alias domain</span>.
+                 name="addaliasForwardsToDivToggle"
+                 type="radio"
+                 onclick="$('#addaliasForwardsToDiv').toggle(true)">
+          I&rsquo;ll enter the mail users that can send mail claiming to be from
+          <span class="regularalias">the alias address</span>
+          <span class="catchall domainalias">any address on the alias domain</span>.
         </label>
       </div>
+    </div>
+  </fieldset>
+</div>
       <div id="addaliasForwardsToDiv" style="margin-top: .5em; margin-left: 1.4em; display: none;">
         <textarea class="form-control" rows="3" id="addaliasSenders" placeholder="one user per line or separated by commas"></textarea>
       </div>
@@ -77,10 +96,10 @@
 <table id="alias_table" class="table" style="width: auto">
   <thead>
     <tr>
-      <th></th>
+      <th scope="col" aria-label="Actions"></th> 
-      <th>Alias<br></th>
+      <th scope="col"> Alias<br></th>
-      <th>Forwards To</th>
+      <th scope="col"> Forwards To</th>
-      <th>Permitted Senders</th>
+      <th scope="col"> Permitted Senders</th>
     </tr>
   </thead>
   <tbody>
@@ -122,7 +141,9 @@
 <h4 style="margin-bottom: 0">Verbs</h4>
 
 <table class="table" style="margin-top: .5em">
-<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<thead><tr>
+<th scope="col"> Verb</th> <th scope="col"> Action</th><th scope="col"> </th>
+</tr></thead>
 <tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail aliases. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
 <tr><td>POST</td><td>/add</td> <td>Adds a new mail alias. Required POST-body parameters are <code>address</code> and <code>forwards_to</code>.</td></tr>
 <tr><td>POST</td><td>/remove</td> <td>Removes a mail alias. Required POST-body parameter is <code>address</code>.</td></tr>
@@ -153,7 +174,7 @@ function show_aliases() {
     function(r) {
       $('#alias_table tbody').html("");
       for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><th colspan='4' style='background-color: #EEE'></th></tr>");
+        var hdr = $("<tr><th role='heading' aria-level='4' colspan='4' style='background-color: #EEE'></th></tr>");
         hdr.find('th').text(r[i].domain);
         $('#alias_table tbody').append(hdr);
 

management/templates/custom-dns.html

@@ -64,12 +64,12 @@
   <a href="#" onclick="window.miab_custom_dns_data_sort_order='created'; show_current_custom_dns_update_after_sort(); return false;">created</a>
 </div>
 <table id="custom-dns-current" class="table" style="width: auto; display: none; margin-top: 0;">
-  <thead>
+  <thead><tr>
-    <th>Domain Name</th>
+    <th scope="col"> Domain Name</th>
-    <th>Record Type</th>
+    <th scope="col"> Record Type</th>
-    <th>Value</th>
+    <th scope="col"> Value</th>
-    <th></th>
+    <th scope="col" aria-label="Actions"></th>
-  </thead>
+  </tr></thead>
   <tbody>
     <tr><td colspan="4">Loading...</td></tr>
   </tbody>
@@ -119,7 +119,9 @@
 <h4>Verbs</h4>
 
 <table class="table">
-<thead><th>Verb</th> <th>Usage</th></thead>
+<thead><tr
+<th scope="col"> Verb</th> <th scope="col"> Usage</th>
+</tr></thead>
 <tr><td>GET</td> <td>Returns matching custom DNS records as a JSON array of objects. Each object has the keys <code>qname</code>, <code>rtype</code>, and <code>value</code>. The optional <code>qname</code> and <code>rtype</code> parameters in the request URL filter the records returned in the response. The request body (<code>-d "..."</code>) must be omitted.</td></tr>
 <tr><td>PUT</td> <td>Sets a custom DNS record replacing any existing records with the same <code>qname</code> and <code>rtype</code>. Use PUT (instead of POST) when you only have one value for a <code>qname</code> and <code>rtype</code>, such as typical <code>A</code> records (without round-robin).</td></tr>
 <tr><td>POST</td> <td>Adds a new custom DNS record. Use POST when you have multiple <code>TXT</code> records or round-robin <code>A</code> records. (PUT would delete previously added records.)</td></tr>
@@ -129,7 +131,9 @@
 <h4>Parameters</h4>
 
 <table class="table">
-<thead><th>Parameter</th> <th>Value</th></thead>
+<thead><tr>
+<th scope="col"> Parameter</th> <th scope="col"> Value</th>
+</tr></thead>
 <tr><td>email</td> <td>The email address of any administrative user here.</td></tr>
 <tr><td>password</td> <td>That user&rsquo;s password.</td></tr>
 <tr><td>qname</td> <td>The fully qualified domain name for the record you are trying to set. It must be one of the domain names or a subdomain of one of the domain names hosted on this box. (Add mail users or aliases to add new domains.)</td></tr>
@@ -214,7 +218,7 @@ function show_current_custom_dns_update_after_sort() {
       var last_zone = null;
       for (var i = 0; i < data.length; i++) {
         if (sort_key == "qname" && data[i].zone != last_zone) {
-          var r = $("<tr><th colspan=4 style='background-color: #EEE'></th></tr>");
+          var r = $("<tr><th role='heading' aria-level='4' colspan=4 style='background-color: #EEE'></th></tr>");
           r.find("th").text(data[i].zone);
           tbody.append(r);
           last_zone = data[i].zone;

management/templates/external-dns.html

@@ -59,9 +59,9 @@
 <table id="external_dns_settings" class="table">
 	<thead>
 		<tr>
-			<th>QName</th>
+			<th scope="col">QName</th>
-			<th>Type</th>
+			<th scope="col">Type</th>
-			<th>Value</th>
+			<th scope="col">Value</th>
 		</tr>
 	</thead>
 	<tbody>

management/templates/index.html

@@ -215,11 +215,11 @@
           </div>
         </div>
 
-        <div id="global_modal" class="modal fade" tabindex="-1" role="dialog" aria-labelledby="errorModalTitle" aria-hidden="true">
+        <div id="global_modal" class="modal fade" tabindex="-1" role="dialog" aria-modal="true" aria-labelledby="errorModalTitle">
           <div class="modal-dialog modal-sm">
             <div class="modal-content">
               <div class="modal-header">
-                <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
+                <button type="button" class="close" data-dismiss="modal" aria-label="Close Dialog">&times;</button>
                 <h4 class="modal-title" id="errorModalTitle"> </h4>
               </div>
               <div class="modal-body">

management/templates/mail-guide.html

@@ -24,16 +24,16 @@
 
 					<table class="table">
 					<thead>
-						<tr><th>Option</th> <th>Value</th></tr>
+						<tr><th scope="col">Option</th> <th scope="col">Value</th></tr>
 					</thead>
-					<tr><th>Protocol/Method</th> <td>IMAP</td></tr>
+					<tr><th scope="row">Protocol/Method</th> <td>IMAP</td></tr>
-					<tr><th>Mail server</th> <td>{{hostname}}</td>
+					<tr><th scope="row">Mail server</th> <td>{{hostname}}</td>
-					<tr><th>IMAP Port</th> <td>993</td></tr>
+					<tr><th scope="row">IMAP Port</th> <td>993</td></tr>
-					<tr><th>IMAP Security</th> <td>SSL or TLS</td></tr>
+					<tr><th scope="row">IMAP Security</th> <td>SSL or TLS</td></tr>
-					<tr><th>SMTP Port</th> <td>465</td></tr>
+					<tr><th scope="row">SMTP Port</th> <td>465</td></tr>
-					<tr><th>SMTP Security</td> <td>SSL or TLS</td></tr>
+					<tr><th scope="row">SMTP Security</td> <td>SSL or TLS</td></tr>
-					<tr><th>Username:</th> <td>Your whole email address.</td></tr>
+					<tr><th scope="row">Username:</th> <td>Your whole email address.</td></tr>
-					<tr><th>Password:</th> <td>Your mail password.</td></tr>
+					<tr><th scope="row">Password:</th> <td>Your mail password.</td></tr>
 					</table>
 
 					<p>In addition to setting up your email, you&rsquo;ll also need to set up <a href="#sync_guide">contacts and calendar synchronization</a> separately.</p>
@@ -45,8 +45,8 @@
 					<p>On iOS devices, devices on this <a href="https://github.com/Z-Hub/Z-Push/wiki/Compatibility">compatibility list</a>, or using Outlook 2007 or later on Windows 7 and later, you may set up your mail as an Exchange or ActiveSync server. However, we&rsquo;ve found this to be more buggy than using IMAP as described above. If you encounter any problems, please use the manual settings above.</p>
 
 					<table class="table">
-					<tr><th>Server</th> <td>{{hostname}}</td></tr>
+					<tr><th scope="row">Server</th> <td>{{hostname}}</td></tr>
-					<tr><th>Options</th> <td>Secure Connection</td></tr>
+					<tr><th scope="row">Options</th> <td>Secure Connection</td></tr>
 					</table>
 
 					<p>Your device should also provide a contacts list and calendar that syncs to this box when you use this method.</p>

management/templates/mfa.html

@@ -67,12 +67,12 @@ and ensure every administrator account for this control panel does the same.</st
         </div>
 
         <div class="form-group">
-            <label for="otp-label" style="font-weight: normal">3. Optionally, give your device a label so that you can remember what device you set it up on:</label>
+            <label for="totp-setup-label" style="font-weight: normal">3. Optionally, give your device a label so that you can remember what device you set it up on:</label>
             <input type="text" id="totp-setup-label" class="form-control" placeholder="my phone" />
         </div>
 
         <div class="form-group">
-            <label for="otp" style="font-weight: normal">4. Use the app to generate your first six-digit code and enter it here:</label>
+            <label for="totp-setup-token" style="font-weight: normal">4. Use the app to generate your first six-digit code and enter it here:</label>
             <input type="text" id="totp-setup-token" class="form-control" placeholder="6-digit code" />
         </div>
 
@@ -132,6 +132,7 @@ and ensure every administrator account for this control panel does the same.</st
     function render_totp_setup(provisioned_totp) {
         var img = document.createElement('img');
         img.src = "data:image/png;base64," + provisioned_totp.qr_code_base64;
+        img.alt = "QR code, scan this in your authenticator app"
 
         var code = document.createElement('div');
         code.innerHTML = `Secret: ${provisioned_totp.secret}`;

management/templates/ssl.html

@@ -28,9 +28,9 @@
 <table id="ssl_domains" class="table" style="margin-bottom: 2em; width: auto; display: none">
   <thead>
     <tr>
-      <th>Domain</th>
+      <th scope="col">Domain</th>
-      <th>Certificate Status</th>
+      <th scope="col">Certificate Status</th>
-      <th>Actions</th>
+      <th scope="col">Actions</th>
     </tr>
   </thead>
   <tbody>
@@ -101,7 +101,7 @@ function show_tls(keep_provisioning_shown) {
       $('#ssldomain').html('<option value="">(select)</option>');
       $('#ssl_domains').show();
       for (var i = 0; i < domains.length; i++) {
-        var row = $("<tr><th class='domain'><a href=''></a></th><td class='status'></td> <td class='actions'><a href='#' onclick='return ssl_install(this);' class='btn btn-xs'>Install Certificate</a></td></tr>");
+        var row = $("<tr><th scope='row' class='domain'><a href=''></a></th><td class='status'></td> <td class='actions'><a href='#' onclick='return ssl_install(this);' class='btn btn-xs'>Install Certificate</a></td></tr>");
         tb.append(row);
         row.attr('data-domain', domains[i].domain);
         row.find('.domain a').text(domains[i].domain);

management/templates/sync-guide.html

@@ -12,9 +12,9 @@
 			<p>You can edit your contacts and calendar from your web browser.</p>
 
 			<table class="table">
-			<thead><tr><th>For...</th> <th>Visit this URL</th></tr></thead>
+			<thead><tr><th scope="col">For...</th> <th scope="col">Visit this URL</th></tr></thead>
-			<tr><th>Contacts</td> <td><a href="https://{{hostname}}/cloud/contacts">https://{{hostname}}/cloud/contacts</a></td></tr>
+			<tr><td>Contacts</td> <td><a href="https://{{hostname}}/cloud/contacts">https://{{hostname}}/cloud/contacts</a></td></tr>
-			<tr><th>Calendar</td> <td><a href="https://{{hostname}}/cloud/calendar">https://{{hostname}}/cloud/calendar</a></td></tr>
+			<tr><td>Calendar</td> <td><a href="https://{{hostname}}/cloud/calendar">https://{{hostname}}/cloud/calendar</a></td></tr>
 			</table>
 
 			<p>Log in settings are the same as with <a href="#mail-guide">mail</a>: your
@@ -29,7 +29,7 @@
 			<p>Otherwise, the app below can synchronize your contacts and calendar to your Android phone.</p>
 
 			<table class="table">
-			<thead><tr><th>Google Play</th> <th>F-Droid</th></tr></thead>
+			<thead><tr><th scope="col">Google Play</th> <th scope="col">F-Droid</th></tr></thead>
 			<tr><td><a href="https://play.google.com/store/apps/details?id=at.bitfire.davdroid">DAVx⁵</a> (paid)</td> <td><a href="https://f-droid.org/packages/at.bitfire.davdroid/">DAVx⁵</a> (free)</td></tr>
 			</table>
 

management/templates/system-backup.html

@@ -171,10 +171,10 @@
 
 <table id="backup-status" class="table" style="width: auto">
   <thead>
-    <th colspan="2">When</th>
+    <th scope="col" colspan="2">When</th>
-    <th>Type</th>
+    <th scope="col">Type</th>
-    <th>Size</th>
+    <th scope="col">Size</th>
-    <th>Deleted in...</th>
+    <th scope="col">Deleted in...</th>
   </thead>
   <tbody>
   </tbody>

management/templates/users.html

@@ -46,11 +46,11 @@
 <table id="user_table" class="table" style="width: auto">
   <thead>
     <tr>
-      <th width="35%">Email Address</th>
+      <th scope="col" width="35%">Email Address</th>
-      <th class="row-center">Size</th>
+      <th scope="col" class="row-center">Size</th>
-      <th class="row-center">Used</th>
+      <th scope="col" class="row-center">Used</th>
-      <th class="row-center">Quota</th>
+      <th scope="col" class="row-center">Quota</th>
-      <th>Actions</th>
+      <th scope="col">Actions</th>
     </tr>
   </thead>
   <tbody>
@@ -115,7 +115,7 @@
 <h4 style="margin-bottom: 0">Verbs</h4>
 
 <table class="table" style="margin-top: .5em">
-<thead><th>Verb</th> <th>Action</th><th></th></thead>
+<thead><th scope="col"> Verb</th> <th scope="col"> Action</th><th scope="col"> </th></thead>
 <tr><td>GET</td><td><i>(none)</i></td> <td>Returns a list of existing mail users. Adding <code>?format=json</code> to the URL will give JSON-encoded results.</td></tr>
 <tr>
     <td>POST</td>
@@ -171,7 +171,7 @@ function show_users() {
     function(r) {
       $('#user_table tbody').html("");
       for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><th colspan='6' style='background-color: #EEE'></th></tr>");
+        var hdr = $("<tr><th role='heading' aria-level='4' colspan='6' style='background-color: #EEE'></th></tr>");
         hdr.find('th').text(r[i].domain);
         $('#user_table tbody').append(hdr);
 

management/templates/web.html

@@ -23,9 +23,9 @@
 <table id="web_domains_existing" class="table" style="margin-bottom: 1em; width: auto;">
         <thead>
                 <tr>
-                        <th>Site</th>
+                        <th scope="col">Site</th>
-                        <th>Directory for Files</th>
+                        <th scope="col">Directory for Files</th>
-			<th/>
+			<th scope="col" aria-label="Actions"/>
                 </tr>
         </thead>
         <tbody>
@@ -48,7 +48,7 @@ function show_web() {
 	tb.text('');
 	for (var i = 0; i < domains.length; i++) {
 		if (!domains[i].static_enabled) continue;
-		var row = $("<tr><th class='domain'><a href=''></a></th><td class='directory'><tt/></td> <td class='change-root hidden'><button class='btn btn-default btn-xs' onclick='show_change_web_root(this)'>Change</button></td></tr>");
+		var row = $("<tr><th scope='colgroup' class='domain'><a href=''></a></th><td class='directory'><tt/></td> <td class='change-root hidden'><button class='btn btn-default btn-xs' onclick='show_change_web_root(this)'>Change</button></td></tr>");
 		tb.append(row);
 		row.attr('data-domain', domains[i].domain);
 		row.attr('data-custom-web-root', domains[i].custom_root);

setup/bootstrap.sh

@@ -23,7 +23,7 @@ if [ -z "$TAG" ]; then
 	if [ "$UBUNTU_VERSION" == "Ubuntu 22.04 LTS" ]; then
 		# This machine is running Ubuntu 22.04, which is supported by
 		# Mail-in-a-Box versions 60 and later.
-		TAG=v74
+		TAG=v75
 	elif [ "$UBUNTU_VERSION" == "Ubuntu 18.04 LTS" ]; then
 		# This machine is running Ubuntu 18.04, which is supported by
 		# Mail-in-a-Box versions 0.40 through 5x.

setup/management.sh

@@ -101,7 +101,7 @@ chmod 640 /var/lib/mailinabox/api.key
 
 source $venv/bin/activate
 export PYTHONPATH=$PWD/management
-exec gunicorn -b localhost:10222 -w 1 --timeout 630 wsgi:app
+exec gunicorn -b 127.0.0.1:10222 -w 1 --timeout 630 wsgi:app
 EOF
 chmod +x $inst_dir/start
 cp --remove-destination conf/mailinabox.service /lib/systemd/system/mailinabox.service # target was previously a symlink so remove it first

setup/webmail.sh

@@ -36,8 +36,8 @@ apt_install \
 #   https://github.com/mstilkerich/rcmcarddav/releases
 # The easiest way to get the package hashes is to run this script and get the hash from
 # the error message.
-VERSION=1.6.12
+VERSION=1.6.15
-HASH=544bc6b91a19bf1cc4a1255c5106a732325e1ce7
+HASH=1228dce33d7dd4085529d0ccc920deb603cd4e04
 PERSISTENT_LOGIN_VERSION=bde7b6840c7d91de627ea14e81cf4133cbb3c07a # version 5.3
 HTML5_NOTIFIER_VERSION=68d9ca194212e15b3c7225eb6085dbcf02fd13d7 # version 0.6.4+
 CARDDAV_VERSION=4.4.3