{"id":"CVE-2026-119761","kind":"vulnerability","aliases":["CVE-2026-119761"],"related":[],"title":"Axigen WebMail: sender display names run script in the conversation view","description":"Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.","summary":"Axigen Mail Server's WebMail does not escape sender display names in the conversation view. An attacker who sends an email with script in the From display name can run that script in the browser of the recipient when they open the folder, enabling mailbox content theft or redirection.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axigen","infrastructure","mail-server","self-hosted","webmail"],"not_affected_if":["versions-patched","webmail-disabled"],"how_to_check":"- Find the Axigen WebMail version in the admin console or the WebMail footer and compare it with the fixed versions","fix":"- Axigen Mail Server WebMail: upgrade to `10.6.39` on the 10.6 line or `10.7.1` on the 10.7 line","status":"open","published_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:57:09+00:00","updated_at":"2026-10-30T18:57:09+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T18:57:09Z","model":"claude-haiku-5-5","output":{"fix":"- Axigen Mail Server WebMail: upgrade to `10.6.39` on the 10.6 line or `10.7.1` on the 10.7 line","reach":"internet","title":"Axigen WebMail: sender display names run script in the conversation view","impact":"medium","summary":"Axigen Mail Server's WebMail does not escape sender display names in the conversation view. An attacker who sends an email with script in the From display name can run that script in the browser of the recipient when they open the folder, enabling mailbox content theft or redirection.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["axigen","webmail","mail-server","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in mail users' browsers, exposing mailbox content","analyst_note":"","how_to_check":"- Find the Axigen WebMail version in the admin console or the WebMail footer and compare it with the fixed versions\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["webmail-disabled","versions-patched"],"who_is_affected":"Teams that run Axigen Mail Server with WebMail enabled and users who open mail through it. The flaw is in the WebMail conversation view, so deployments that do not expose WebMail are not reached by this route. The sources do not say whether any configuration other than WebMail being in use changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4164,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119761':14A,17A '-2026':13A,16A '10.6.39':81C '10.7.1':83C 'allow':93C 'attack':43B,96C,109C 'axigen':1A,18B,27B,76C 'browser':61B 'contain':84C 'content':72B,133C 'convers':10A,40B,107C 'cross':88C 'cross-sit':87C 'cve':12A,15A 'display':4A,36B,53B,103C,121C 'email':47B,113C 'enabl':70B,131C 'escap':34B 'execut':124C 'folder':69B,130C 'host':25B 'html':115C 'infrastructur':19B 'inject':98C 'mail':21B,28B,77C 'mail-serv':20B 'mailbox':71B,132C 'name':5A,37B,54B,104C,122C 'open':67B,128C 'recipi':64B,127C 'redirect':75B,136C 'remot':95C 'run':6A,56B 'script':7A,49B,58B,90C,99C,117C 'self':24B 'self-host':23B 'send':45B,111C 'sender':3A,35B,102C 'server':22B,29B,78C 'site':89C 'store':86C 'theft':73B,134C 'unauthent':94C 'unescap':101C 'via':100C 'view':11A,41B,108C 'vulner':91C 'webmail':2A,26B,31B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Axigen Mail Server with WebMail enabled and users who open mail through it. The flaw is in the WebMail conversation view, so deployments that do not expose WebMail are not reached by this route. The sources do not say whether any configuration other than WebMail being in use changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119761","severity":null,"published_at":"2026-10-30T18:17:26+00:00","modified_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}