The new mobile interface doesn't seem to work with the action links in the quarantine emails.
The ticket param works fine and the interface loads logged in, but if you click the email links to view a specific email, whitelist, blacklist, deliver, or delete - nothing happens other than bringing you to the list of quarantined emails.

e.g.
the link https://spam.mydomain.here/quarantine?ticket=PMGQUAR%3Ametheos%40somewhere.net<rest of ticket>&cselect=C2R459649T91608054&date=2025-10-23&action=deliver

should deliver the email to the user, but if on mobile this link only logs in to the new mobile ui with no action or email selected.

sure. This is the output from clicking to view an email from the quarantine report.
I didn't see any output from the click in journalctl or in /var/log/syslog
here's the relevant proxy log from /var/log/pmgproxy/pmgproxy.log

::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /quarantine?ticket=PMGQUAR%253Ame%2540somewhere.net%25<TICKET PARAMS>&cselect=C3R460858T210691328&date=2025-10-27 HTTP/1.1" 200 930
::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /mobile/pmg-mobile-quarantine-ui_bundle.js?v=1761595895 HTTP/1.1" 200 10560
::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /fontawesome/css/font-awesome.css HTTP/1.1" 200 7289
::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /mobile/pmg-mobile-quarantine-ui_bg.wasm.gz?v=1761595895 HTTP/1.1" 200 910043
::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /mobile/images/proxmox_logo_white.svg HTTP/1.1" 200 1036
::ffff:10.0.0.13 - me@somewhere.net@quarantine [28/10/2025:08:42:52 -0500] "GET /api2/extjs/nodes/localhost/subscription HTTP/1.1" 200 190
::ffff:10.0.0.13 - - [28/10/2025:08:42:52 -0500] "GET /mobile/css/mobile-yew-style.css?v1761595895 HTTP/1.1" 200 19526
::ffff:10.0.0.13 - me@somewhere.net@quarantine [28/10/2025:08:42:52 -0500] "GET /api2/extjs/quarantine/spam?endtime=1761714000&starttime=1761109200 HTTP/1.1" 200 1395

Thanks for the report! we managed to reproduce the issue - and are currently working on a patch:
https://lore.proxmox.com/pmg-devel/20251028163628.79739-1-s.ivanov@proxmox.com/T/#t

Once we apply an improved version it should work again!

Will this patch also fix the issue with not seeing the correct quarantine folder, when managing multiple mailboxes on a mobile phone?

Explanation: ever since upgrading to PMG 9.x, when we click on a quarantine message link of mailbox A it goes to the list of quarantined emails instead of directly to the clicked email. After clicking on a quarantine message link of mailbox B, it opens the stale quarantined emails list of previously visited mailbox A, unless the user either 1) previously manually logged out or 2) switches from mobile to desktop view and then back to mobile view.

1) This is super confusing, as when the quarantined emails list is shown, it's not obvious which mailbox the user is looking at (since recipient info is not shown). The user sees a stale list, thinking he's looking at mailbox B, while the information shown is actually from mailbox A.

2) You shouldn't expect the quarantine mobile viewers having to logout. In PMG 8.x this wasn't necessary and looking at quarantined messages for multiple mailboxes (eg. different companies) was quick and worked like a charm on mobile. In PMG 9.x this is broken.

Thanks!

I installed this update today
pmg-mobile-quarantine-ui (0.4.0) trixie; urgency=medium

* execute actions when opening gui from a link from quarantine mails.

-- Proxmox Support Team <support@proxmox.com> Thu, 04 Dec 2025 20:02:53 +0100

Unfortunately it appears that the actions don't actually execute unless the user is logged in. The API endpoints don't seem to respect the auth provided by the quarantine email links.
Clicking an email link (not one of the action links) also still doesn't load that email, it just lands the user on the spam mail list.

Example delete action posts to https://<pmg host>/api2/extjs/quarantine/content
with data {"action":"delete","id":"C1R486493T636697"}

returns 401 and the site displays 'api returned unexpected data - expected json body, but no Content-Type was sent'

Updated to 9.1 today and I can see there has been some improvement.
While the actions seem to be working well, clicking an email subject in the e-mailed list still only takes you to the quarantine page. It does not load the selected email into view. the user still needs to manually locate the email they just clicked on in order to view it.

On desktop, the clicked email loads the selected email automatically.

Example link:
https://spam.<my server>/quarantine?ticket=<TICKET>&cselect=C3R560442T144138559&date=2026-06-09