CVE-2026-123620 · Runtime
NO FIX YET · SEE WHAT TO DO
Usermin's Read Mail module passes IMAP folder names to a shell without sanitizing them. An authenticated user can create a folder with shell metacharacters through an external IMAP client, then delete it in Usermin to run commands as their system account.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Servers running Usermin through 2.570 with the Read Mail module enabled, where users can log in and also reach the mailbox over IMAP. The attack needs an account on the system, so servers where only administrators have logins are at lower risk. unknown whether other configurations are affected.
Not affected if auth-required, usermin-not-installed
Who cares linux, self-hosted, usermin, webmail
usermin --version or the package manager's query) and compare it with the fixed version in the sources.Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.