CVE-2026-121551 in PostfixAdmin
Summary
by MITRE • 11/03/2026
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
PostfixAdmin versions through 4.0.5 are susceptible to a stored cross-site scripting vulnerability that arises from insufficient input validation within the TOTP exception management functionality. This flaw specifically affects the handling of description fields when users create exceptions for two-factor authentication requirements. The application fails to properly sanitize or encode user-supplied data before storing it in the backend database and subsequently rendering it back into HTML content without adequate escaping mechanisms. Consequently, an authenticated mailbox user can inject malicious script payloads by crafting a specially formatted TOTP exception entry with a description field containing executable JavaScript code rather than plain text.
The severity of this vulnerability is significantly amplified because the stored payload persists on the server side until manually removed or expired. When a global administrator accesses the totp-exceptions.php page to review existing exceptions, the browser automatically executes the injected script within the context of the admin's active session. This execution occurs in a privileged environment where the administrator possesses elevated rights compared to standard mailbox users. The presence of this vulnerability effectively bypasses the intended security boundary between regular user accounts and administrative interfaces, allowing lower-privilege actors to escalate their influence over the system through social engineering or automated exploitation techniques targeting administrators.
The operational impact extends beyond simple script execution due to the availability of Cross-Site Request Forgery tokens within the admin session context. Because the malicious scripts run with full administrator privileges, they can leverage these CSRF tokens to forge authenticated requests on behalf of the global administrator. This capability enables attackers to perform arbitrary actions such as modifying system configurations, creating new administrative accounts, deleting critical data, or installing backdoors without detection through standard user activity logs that might not distinguish between legitimate and forged admin operations. The combination of stored XSS and CSRF token theft creates a potent attack vector for complete account takeover and persistent compromise of the mail administration infrastructure.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a Stored XSS variant where malicious content is saved on target servers and delivered to users later. In terms of tactical mapping within the MITRE ATT&CK framework, this flaw facilitates Initial Access through phishing or lure-based attacks targeting administrators, followed by Execution via browser script execution, and potentially Persistence if new accounts are created. It also relates to CWE-352 Cross-Site Request Forgery due to the abuse of valid authentication tokens for unauthorized command execution.
Mitigation strategies should prioritize immediate patching to version 4.0.6 or later where input sanitization is properly implemented across all user-facing fields, particularly those rendered in administrative interfaces. Developers must enforce strict output encoding using context-aware escaping techniques such as HTML entity encoding when displaying stored data within HTML documents. Additionally implementing robust Content Security Policy headers can mitigate the impact of any remaining XSS vectors by restricting script execution sources. For existing deployments where patching is not immediately feasible, administrators should review TOTP exception logs regularly for suspicious entries and consider disabling direct access to administrative pages from untrusted networks or requiring additional out-of-band authentication factors for sensitive operations like viewing user exceptions.