{"id":"UBUNTU-CVE-2026-121551","details":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","modified":"2026-11-05T11:46:32.797482175Z","published":"2026-11-03T16:17:00Z","upstream":["CVE-2026-121551"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-121551"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-121551"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/issues/1185"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/pull/1172"},{"type":"REPORT","url":"https://github.com/postfixadmin/postfixadmin/pull/1186"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description"}],"affected":[{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7-1","2.3.7-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"postfixadmin","binary_version":"2.3.7-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-2","3.0.2-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.2-2ubuntu0.1~esm1","binary_name":"postfixadmin"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-2","3.2.1-3","3.2.1-3ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"postfixadmin","binary_version":"3.2.1-3ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.7-1","3.3.10-2","3.3.10-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"postfixadmin","binary_version":"3.3.10-2ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.13-1","3.3.13-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.3.13-1ubuntu0.1~esm1","binary_name":"postfixadmin"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.1+ds-1","4.0.4+ds-1","4.0.5+ds-1"],"ecosystem_specific":{"binaries":[{"binary_name":"postfixadmin","binary_version":"4.0.5+ds-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}},{"package":{"name":"postfixadmin","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/postfixadmin?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15+ds-2","4.0.1+ds-1"],"ecosystem_specific":{"binaries":[{"binary_version":"4.0.1+ds-1","binary_name":"postfixadmin"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-121551.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"type":"Ubuntu","score":"medium"}]}