{"id":"CVE-2026-121551","aliases":["DEBIAN-CVE-2026-121551","EUVD-2026-115896","GHSA-3mcr-px3q-mcw8","UBUNTU-CVE-2026-121551"],"status":"published","title":"PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00283,"percentile":0.21072,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-03T15:17:10Z","modified":"2026-11-11T15:00:06Z","affected":[{"source":"osv","ecosystem":"Debian:14","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15+ds-2","4.0.1+ds-1","4.0.4+ds-1","4.0.5+ds+~cs20.241.5-1","4.0.5+ds-1","4.0.6+ds+~cs20.241.7-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7-1","2.3.7-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-2","3.0.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-2","3.2.1-3","3.2.1-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.7-1","3.3.10-2","3.3.10-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.13-1","3.3.13-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1+ds-1","4.0.4+ds-1","4.0.5+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15+ds-2","4.0.1+ds-1"]}],"products":[{"vendor":"postfixadmin","product":"postfixadmin"}],"references":[{"url":"https://github.com/postfixadmin/postfixadmin/issues/1185","tags":["issue-tracking","report"]},{"url":"https://github.com/postfixadmin/postfixadmin","tags":["product","package","report"]},{"url":"https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c","tags":["patch","fix","report"]},{"url":"https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128","tags":["technical-description","article","report"]},{"url":"https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56","tags":["technical-description","article","report"]},{"url":"https://github.com/postfixadmin/postfixadmin/pull/1172","tags":["technical-description","patch","issue-tracking","fix","report"]},{"url":"https://github.com/postfixadmin/postfixadmin/pull/1186","tags":["technical-description","patch","issue-tracking","fix","report"]},{"url":"https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121551","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mcr-px3q-mcw8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121551.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121551","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121551","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-121551","title":"PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T15:17:10.145Z","modified":"2026-11-03T18:27:55.973Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T20:02:16.924578Z"}],"euvd":[{"id":"EUVD-2026-115896","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T15:17:10Z","modified":"2026-11-03T18:27:55Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-03T21:20:13.974366Z"}],"ghsa":[{"id":"GHSA-3mcr-px3q-mcw8","title":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows...","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T18:31:05Z","modified":"2026-11-03T18:31:09Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T19:01:31.965978Z"}],"nvd":[{"id":"CVE-2026-121551","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T16:17:27.077Z","modified":"2026-11-03T19:18:04.723Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T22:58:51.822037Z"}],"osv":[{"id":"CVE-2026-121551","title":"PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T15:17:10.145Z","modified":"2026-11-05T03:31:07.601142959Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"DEBIAN-CVE-2026-121551","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T16:17:27.077Z","modified":"2026-11-11T15:00:06.134973213Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T15:13:22.400702Z"},{"id":"UBUNTU-CVE-2026-121551","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","status":"published","published":"2026-11-03T16:17:00Z","modified":"2026-11-05T11:46:32.797482175Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-05T13:30:15.321876Z"}]}}