{"id":"CVE-2026-123622","kind":"vulnerability","aliases":["CVE-2026-123622"],"related":[],"title":"Usermin: email attachment XSS runs script in logged-in webmail sessions","description":"Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.","summary":"Usermin's mailbox/detach.cgi page does not filter the type parameter, so an HTML attachment or crafted link can run JavaScript in a victim's authenticated Usermin session. An attacker who gets a user to open the link can act as that user inside their mail session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","usermin","webmail"],"not_affected_if":["mailbox-module-disabled"],"how_to_check":"- Check the installed Usermin version (for example with `usermin -v` or the package manager) and compare it with the fixed release in the product data.\n- Look for `mailbox/detach.cgi` in the Usermin web server access logs with `type=text/html`.","fix":null,"status":"open","published_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:32+00:00","updated_at":"2026-11-06T15:44:32+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T15:44:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Usermin: email attachment XSS runs script in logged-in webmail sessions","impact":"medium","summary":"Usermin's mailbox/detach.cgi page does not filter the type parameter, so an HTML attachment or crafted link can run JavaScript in a victim's authenticated Usermin session. An attacker who gets a user to open the link can act as that user inside their mail session.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["usermin","webmail","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in the victim's logged-in Usermin session, exposing mail","analyst_note":"Confirm the fixed Usermin version from the patch link on github.com and whether the flaw needs an authenticated session beyond the victim click.","how_to_check":"- Check the installed Usermin version (for example with `usermin -v` or the package manager) and compare it with the fixed release in the product data.\n- Look for `mailbox/detach.cgi` in the Usermin web server access logs with `type=text/html`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["mailbox-module-disabled"],"who_is_affected":"Teams running Usermin webmail through 2.570 are exposed, since the flaw is in the mailbox attachment handler that renders email content. Installations without Usermin's mailbox module, or with the module disabled, are unlikely to be affected. The sources do not state a fixed version beyond the patch link.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4297,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123622':15A,18A '-2026':14A,17A '2.570':73C 'act':63B 'allow':84C 'arbitrari':93C 'attach':3A,38B,105C 'attack':53B,86C,100C 'authent':49B,125C 'bypass':97C 'contain':74C,106C 'craft':40B 'cross':77C 'cross-sit':76C 'cve':13A,16A 'detach.cgi':113C 'email':2A,102C 'execut':88C 'filter':31B,99C 'get':55B 'host':22B 'html':37B,104C 'insid':67B 'javascript':44B,98C 'link':41B,61B,114C 'log':9A 'logged-in':8A 'lure':109C 'mail':69B 'mailbox/detach.cgi':27B,82C 'open':59B 'page':28B 'paramet':34B,95C 'recipi':110C 'remot':85C 'run':5A,43B,119C 'runtim':19B 'script':6A,79C,89C,107C,120C 'self':21B 'self-host':20B 'session':12A,51B,70B,127C 'site':78C 'suppli':91C 'text/html':117C 'type':33B,94C,116C 'user':57B,66B 'usermin':1A,23B,25B,50B,71C,126C 'victim':47B,123C 'vulner':80C 'webmail':11A,24B 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Teams running Usermin webmail through 2.570 are exposed, since the flaw is in the mailbox attachment handler that renders email content. Installations without Usermin's mailbox module, or with the module disabled, are unlikely to be affected. The sources do not state a fixed version beyond the patch link.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","runtime","selfhosted","usermin","webmail"],"campaign_type":null,"search_a":"'-123622':15A,18A '-2026':14A,17A 'attach':3A 'cve':13A,16A 'email':2A 'log':9A 'logged-in':8A 'run':5A 'script':6A 'session':12A 'usermin':1A 'webmail':11A 'xss':4A","search_b":"'act':63B 'attach':38B 'attack':53B 'authent':49B 'craft':40B 'filter':31B 'get':55B 'host':22B 'html':37B 'insid':67B 'javascript':44B 'link':41B,61B 'mail':69B 'mailbox/detach.cgi':27B 'open':59B 'page':28B 'paramet':34B 'run':43B 'runtim':19B 'self':21B 'self-host':20B 'session':51B,70B 'type':33B 'user':57B,66B 'usermin':23B,25B,50B 'victim':47B 'webmail':24B","search_c":"'2.570':73C 'allow':84C 'arbitrari':93C 'attach':105C 'attack':86C,100C 'authent':125C 'bypass':97C 'contain':74C,106C 'cross':77C 'cross-sit':76C 'detach.cgi':113C 'email':102C 'execut':88C 'filter':99C 'html':104C 'javascript':98C 'link':114C 'lure':109C 'mailbox/detach.cgi':82C 'paramet':95C 'recipi':110C 'remot':85C 'run':119C 'script':79C,89C,107C,120C 'session':127C 'site':78C 'suppli':91C 'text/html':117C 'type':94C,116C 'usermin':71C,126C 'victim':123C 'vulner':80C","first_public_at":"2026-11-06T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123622","severity":null,"published_at":"2026-11-06T15:17:19+00:00","modified_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87579,"url":"https://github.com/webmin/usermin/commit/c5c43b9ad04a60809ac2eb271bf8f3d0fec2e46a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87580,"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-xss-via-mailbox-detach-cgi-type-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}