CVE-2026-121551 — Vulnerability intelligence

—

Published: 2026-11-03T16:17:27.077

CVSS

5.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

Sources

• CVE-2026-121551
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory