CVE-2026-123622 · Runtime
NO FIX YET
Usermin's mailbox/detach.cgi page does not filter the type parameter, so an HTML attachment or crafted link can run JavaScript in a victim's authenticated Usermin session. An attacker who gets a user to open the link can act as that user inside their mail session.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Usermin webmail through 2.570 are exposed, since the flaw is in the mailbox attachment handler that renders email content. Installations without Usermin's mailbox module, or with the module disabled, are unlikely to be affected. The sources do not state a fixed version beyond the patch link.
Not affected if mailbox-module-disabled
Who cares self-hosted, usermin, webmail
usermin -v or the package manager) and compare it with the fixed release in the product data.mailbox/detach.cgi in the Usermin web server access logs with type=text/html.No fix yet, per the sources.
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.