{"id":"CVE-2026-129169","kind":"vulnerability","aliases":["CVE-2026-129169"],"related":[],"title":"PMail: stored cross-site scripting through the send-email API","description":"PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.","summary":"PMail versions 2.5.0 through 2.9.8 accept unsanitized HTML sent to /api/email/send, so a logged-in user can store a script in a message. When an administrator opens that message, the script runs in their session and can call privileged APIs such as password changes, enabling account takeover.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PMail","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","other","pmail","self-hosted"],"not_affected_if":["no-untrusted-accounts","version-outside-range"],"how_to_check":"- Check the installed PMail version against the affected range `2.5.0` through `2.9.8`.\n- Confirm whether untrusted users can authenticate to the PMail instance and call `/api/email/send`.","fix":null,"status":"open","published_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:49+00:00","updated_at":"2026-11-13T18:51:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T18:51:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PMail: stored cross-site scripting through the send-email API","impact":"high","summary":"PMail versions 2.5.0 through 2.9.8 accept unsanitized HTML sent to /api/email/send, so a logged-in user can store a script in a message. When an administrator opens that message, the script runs in their session and can call privileged APIs such as password changes, enabling account takeover.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pmail","self-hosted","email"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"administrator session hijacked, account takeover through privileged API calls","analyst_note":"Confirm the fixed version and whether the upstream PMail release notes or the vulncheck advisory name one; the sources here give none.","how_to_check":"- Check the installed PMail version against the affected range `2.5.0` through `2.9.8`.\n- Confirm whether untrusted users can authenticate to the PMail instance and call `/api/email/send`.","plain_action":"","product_name":"PMail","needs_analyst":true,"not_affected_if":["version-outside-range","no-untrusted-accounts"],"who_is_affected":"Teams that run PMail 2.5.0 through 2.9.8 with user accounts that can send through /api/email/send are exposed, because the stored script executes when an administrator views the message. Instances where only trusted users can log in, or that run a later version, are not affected by this description. The sources do not name a fixed version.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4600,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129169':15A,18A '-2026':14A,17A '/api/email/send':36B,98C '2.5.0':28B,75C '2.9.8':30B,77C 'accept':31B 'account':72B,125C 'administr':52B,112C 'allow':87C 'api':12A,66B,118C 'attack':99C 'authent':88C 'call':64B,119C 'chang':70B,123C 'contain':78C 'cross':4A,82C 'cross-sit':3A,81C 'cve':13A,16A 'email':11A,20B 'emb':101C 'enabl':71B,116C 'event':103C 'event-handl':102C 'execut':110C 'handler':104C 'host':25B 'html':33B,96C 'img':107C 'inject':91C 'like':106C 'log':40B 'logged-in':39B 'messag':49B,55B,115C 'onerror':108C 'open':53B 'password':69B,122C 'payload':105C 'pmail':1A,19A,22B,26B,74C 'privileg':65B,117C 'run':58B 'script':6A,46B,57B,84C,92C 'self':24B 'self-host':23B 'send':10A,94C 'send-email':9A 'sent':34B 'session':61B 'site':5A,83C 'store':2A,44B,80C 'takeov':73B,126C 'unsanit':32B,95C 'user':42B,89C 'version':27B 'view':113C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams that run PMail 2.5.0 through 2.9.8 with user accounts that can send through /api/email/send are exposed, because the stored script executes when an administrator views the message. Instances where only trusted users can log in, or that run a later version, are not affected by this description. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["pmail"],"ptokens":["pmail"],"labels":["email","medium","other","pmail","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129169':15A,18A '-2026':14A,17A 'api':12A 'cross':4A 'cross-sit':3A 'cve':13A,16A 'email':11A 'pmail':1A,19A 'script':6A 'send':10A 'send-email':9A 'site':5A 'store':2A","search_b":"'/api/email/send':36B '2.5.0':28B '2.9.8':30B 'accept':31B 'account':72B 'administr':52B 'api':66B 'call':64B 'chang':70B 'email':20B 'enabl':71B 'host':25B 'html':33B 'log':40B 'logged-in':39B 'messag':49B,55B 'open':53B 'password':69B 'pmail':22B,26B 'privileg':65B 'run':58B 'script':46B,57B 'self':24B 'self-host':23B 'sent':34B 'session':61B 'store':44B 'takeov':73B 'unsanit':32B 'user':42B 'version':27B","search_c":"'/api/email/send':98C '2.5.0':75C '2.9.8':77C 'account':125C 'administr':112C 'allow':87C 'api':118C 'attack':99C 'authent':88C 'call':119C 'chang':123C 'contain':78C 'cross':82C 'cross-sit':81C 'emb':101C 'enabl':116C 'event':103C 'event-handl':102C 'execut':110C 'handler':104C 'html':96C 'img':107C 'inject':91C 'like':106C 'messag':115C 'onerror':108C 'password':122C 'payload':105C 'pmail':74C 'privileg':117C 'script':84C,92C 'send':94C 'site':83C 'store':80C 'takeov':126C 'unsanit':95C 'user':89C 'view':113C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129169","severity":null,"published_at":"2026-11-13T18:17:42+00:00","modified_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148627,"url":"https://www.vulncheck.com/advisories/pmail-2.5.0-through-2.9.8-stored-xss-via-api-email-send-html-body","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}