---
id: "CVE-2026-121551"
kind: "vulnerability"
aliases: ["CVE-2026-121551"]
title: "PostfixAdmin: stored XSS in TOTP exception description runs in admin session"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mail-server", "package", "postfixadmin", "self-hosted"]
not_affected_if: ["no-mailbox-users-on-admin-instance", "totp-exceptions-unused"]
published_at: "2026-11-03T16:17:27+00:00"
first_seen_at: "2026-11-03T16:21:44+00:00"
updated_at: "2026-11-03T16:24:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121551", "first_seen_at": "2026-11-03T16:21:44+00:00"}]
---

# PostfixAdmin: stored XSS in TOTP exception description runs in admin session

PostfixAdmin through 4.0.5 does not escape the description field of a TOTP exception, so a logged-in mailbox user can store script that runs when a global administrator opens totp-exceptions.php. The script runs in the admin's session and can send authenticated admin requests using the page's CSRF token.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PostfixAdmin version against the product range `through 4.0.5`
- Look for TOTP exception support in the admin area (totp-exceptions.php)

## Fix

- PostfixAdmin: fixed version unknown from the sources; a patch link is listed in the advisory references

## Timeline

- 2026-11-03T16:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121551

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description
- [fix] Patch: github.com https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c

## From the sources

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_