CVE-2026-121551

MEDIUM 5.4

PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

CWE	CWE-79
Vendor	postfixadmin
Product	postfixadmin
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for postfixadmin postfixadmin

Be the first to know when new medium vulnerabilities affecting postfixadmin postfixadmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

postfixadmin / postfixadmin

0 ≤ 4.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/postfixadmin/postfixadmin/issues/1185 github.com: https://github.com/postfixadmin/postfixadmin github.com: https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c github.com: https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128 github.com: https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56 github.com: https://github.com/postfixadmin/postfixadmin/pull/1172 github.com: https://github.com/postfixadmin/postfixadmin/pull/1186 vulncheck.com: https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description

Credits

George Chen TrapoSAMA