Hello,

As a lot of companies (as of mine) are currently using your webmail for corporation purposes (or SaaS models), the urge to provide a fix to this vulnerability feels very high at the moment.

The vulnerability is quite simple to understand : no rel="noopener" are automatically added to xx sent and received through the webmail.
This allows in the worst case malicious users to execute Javascript code through the window.opener variable on opened links directly inside the webmail, and in the most easiest case, to simply redirect users to a phishing fake webmail, asking them to log in again.

I tried this on our corporate webmail and managed to fool most of the people with this.
Also, this currently works on other solutions depending on SOGo (iredmail, ...) and even SaaS systems (gandi.net for instance) on which I successfuly applied this exploit.

For more details : https://mathiasbynens.github.io/rel-noopener/