CVE-2026-121551

Name	CVE-2026-121551
Description	PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1153545

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postfixadmin (PTS)	bookworm	3.3.13-1	vulnerable
	trixie	3.3.15+ds-2	vulnerable
	forky, sid	4.0.5+ds+~cs20.241.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
postfixadmin	source	(unstable)	4.0.6+ds+~cs20.241.7-1			1153545

Notes

https://github.com/postfixadmin/postfixadmin/issues/1185
https://github.com/postfixadmin/postfixadmin/pull/1172
https://github.com/postfixadmin/postfixadmin/pull/1186
https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c (postfixadmin-4.0.6)