{"id":"CVE-2026-123620","kind":"vulnerability","aliases":["CVE-2026-123620"],"related":[],"title":"Usermin: IMAP folder names let a logged-in user run system commands","description":"Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.","summary":"Usermin's Read Mail module passes IMAP folder names to a shell without sanitizing them. An authenticated user can create a folder with shell metacharacters through an external IMAP client, then delete it in Usermin to run commands as their system account.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","runtime","self-hosted","usermin","webmail"],"not_affected_if":["auth-required","usermin-not-installed"],"how_to_check":"- Check the installed Usermin version (for example `usermin --version` or the package manager's query) and compare it with the fixed version in the sources.\n- Confirm whether the Read Mail module is enabled and whether users have IMAP access to their accounts.","fix":"- Usermin: unknown (the sources name a patch on github.com but do not state the fixed version).","status":"open","published_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:14+00:00","updated_at":"2026-11-06T15:44:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T15:44:14Z","model":"claude-haiku-5-5","output":{"fix":"- Usermin: unknown (the sources name a patch on github.com but do not state the fixed version).","reach":"network","title":"Usermin: IMAP folder names let a logged-in user run system commands","impact":"high","summary":"Usermin's Read Mail module passes IMAP folder names to a shell without sanitizing them. An authenticated user can create a folder with shell metacharacters through an external IMAP client, then delete it in Usermin to run commands as their system account.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["usermin","self-hosted","webmail","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user runs commands as the system account","analyst_note":"Confirm the fixed version from the GitHub patch and the VulnCheck advisory; the sources do not state it.","how_to_check":"- Check the installed Usermin version (for example `usermin --version` or the package manager's query) and compare it with the fixed version in the sources.\n- Confirm whether the Read Mail module is enabled and whether users have IMAP access to their accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["usermin-not-installed","auth-required"],"who_is_affected":"Servers running Usermin through 2.570 with the Read Mail module enabled, where users can log in and also reach the mailbox over IMAP. The attack needs an account on the system, so servers where only administrators have logins are at lower risk. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4273,"output_tokens":563,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123620':16A,19A '-2026':15A,18A '2.570':71C 'account':68B,119C 'allow':84C 'attack':95C 'authent':43B,85C 'bypass':120C 'client':56B,107C 'command':13A,64B,75C,89C,115C 'contain':72C,100C 'creat':46B,97C 'cve':14A,17A 'delet':58B,109C 'execut':88C 'extern':54B,105C 'folder':3A,34B,48B,93C,99C 'host':24B 'imap':2A,33B,55B,92C,106C 'inject':76C 'let':5A 'linux':20B 'log':8A 'logged-in':7A 'mail':30B,81C 'metacharact':51B,102C 'modul':31B,82C 'name':4A,35B,94C 'os':74C 'pass':32B 'read':29B,80C 'restrict':124C 'run':11A,63B,114C 'runtim':21B 'sanit':40B 'self':23B 'self-host':22B 'shell':38B,50B,101C 'system':12A,67B,118C 'unsanit':91C 'user':10A,44B,86C 'usermin':1A,25B,27B,61B,69C,112C 'via':103C 'vulner':77C 'webmail':26B,122C 'webmail-on':121C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Servers running Usermin through 2.570 with the Read Mail module enabled, where users can log in and also reach the mailbox over IMAP. The attack needs an account on the system, so servers where only administrators have logins are at lower risk. unknown whether other configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","runtime","selfhosted","usermin","webmail"],"campaign_type":null,"search_a":"'-123620':16A,19A '-2026':15A,18A 'command':13A 'cve':14A,17A 'folder':3A 'imap':2A 'let':5A 'log':8A 'logged-in':7A 'name':4A 'run':11A 'system':12A 'user':10A 'usermin':1A","search_b":"'account':68B 'authent':43B 'client':56B 'command':64B 'creat':46B 'delet':58B 'extern':54B 'folder':34B,48B 'host':24B 'imap':33B,55B 'linux':20B 'mail':30B 'metacharact':51B 'modul':31B 'name':35B 'pass':32B 'read':29B 'run':63B 'runtim':21B 'sanit':40B 'self':23B 'self-host':22B 'shell':38B,50B 'system':67B 'user':44B 'usermin':25B,27B,61B 'webmail':26B 'without':39B","search_c":"'2.570':71C 'account':119C 'allow':84C 'attack':95C 'authent':85C 'bypass':120C 'client':107C 'command':75C,89C,115C 'contain':72C,100C 'creat':97C 'delet':109C 'execut':88C 'extern':105C 'folder':93C,99C 'imap':92C,106C 'inject':76C 'mail':81C 'metacharact':102C 'modul':82C 'name':94C 'os':74C 'read':80C 'restrict':124C 'run':114C 'shell':101C 'system':118C 'unsanit':91C 'user':86C 'usermin':69C,112C 'via':103C 'vulner':77C 'webmail':122C 'webmail-on':121C","first_public_at":"2026-11-06T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123620","severity":null,"published_at":"2026-11-06T15:17:19+00:00","modified_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87575,"url":"https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87576,"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}