CVE-2026-121551— PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

Quick assessment

Affected

postfixadmin postfixadmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PostfixAdmin 4.0.5 及更早版本存在存储型跨站脚本（XSS）漏洞。已认证的邮箱用户可以通过创建带有未转义描述的 TOTP 例外来注入脚本。当全局管理员访问页面时，该脚本将在管理员会话中执行，并利用页面上的 CSRF 令牌发起已认证的管理员请求。

CVSS 5.4 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

Source: CVE Program / CVE List V5

Vulnerability Description

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
postfixadmin	postfixadmin	0 ~ 4.0.5	-

II. Public POCs for CVE-2026-121551

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121551

请登录查看更多情报信息。

Other References for CVE-2026-121551 (8)

https://github.com/postfixadmin/postfixadmin product
https://github.com/postfixadmin/postfixadmin/pull/1186 technical-description patch issue-tracking
https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128 technical-description
https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56 technical-description
https://github.com/postfixadmin/postfixadmin/pull/1172 technical-description patch issue-tracking
https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c patch
https://github.com/postfixadmin/postfixadmin/issues/1185 issue-tracking
https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121551

IV. Related Vulnerabilities

Same product: postfixadmin

CVE-2012-0812
Postfix Admin 跨站脚本漏洞

Same vendor: postfixadmin

CVE-2012-0812
Postfix Admin 跨站脚本漏洞

Same weakness: CWE-79