Live › vulnerability › CVE-2026-121551
PostfixAdmin through 4.0.5 does not escape the description field of a TOTP exception, so a logged-in mailbox user can store script that runs when a global administrator opens totp-exceptions.php. The script runs in the admin's session and can send authenticated admin requests using the page's CSRF token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Sites running PostfixAdmin 4.0.5 or earlier where mailbox users can create TOTP exceptions and global administrators open the TOTP exceptions page. The attacker needs a mailbox account on the instance; skip this if the admin interface is not exposed to mailbox users.
No product ranges from the sources yet.
through 4.0.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.
This page as .md · .json · in your agent: get_signal("CVE-2026-121551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.