PostfixAdmin CVE-2026-121551

Requires (1) a valid authenticated mailbox user account on the PostfixAdmin instance, and (2) the TOTP feature enabled (the vulnerable workflow is creating a TOTP exception on totp-exceptions.php; the patched test fixture sets config 'totp' = 'YES'). The stored payload only executes when a global administrator subsequently opens totp-exceptions.php, so admin interaction is a hard prerequisite (UI:P) - it does not fire on its own. Limiting factors that reduce realistic risk below the raw score: exploitation is gated on attacker holding a legitimate low-privilege account (PR:L), on TOTP exceptions being in use, and on an administrator actually viewing the affected list page; the companion app-passwords.php list has the same escaping flaw fixed in the same commit. Affected versions are PostfixAdmin through 4.0.5.

This is a medium-severity stored XSS (vendor CVSS 4.0 base 5.1; CWE-79) whose real-world risk is moderate and clearly bounded, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) tells a consistent story with the description: the injector must already hold a low-privilege mailbox account (PR:L), and exploitation only fires when a global administrator passively views totp-exceptions.php (UI:P). The source-code evidence confirms the mechanism - the patched commit removes the false third argument on $smarty->assign('pExceptions', ...) (and the matching app-passwords assignment), which had disabled Smarty's output escaping, so a stored description was rendered as raw HTML. Impact is limited to the subsequent (admin) system (SC:L/SI:L) rather than the attacker's own account (VC/VI/VA:N), which is why severity stays medium despite the admin-session consequence. KEV status is not listed, so this is not confirmed actively exploited; no EPSS score was supplied, so exploitation probability cannot be quantified from the input and that gap should be noted rather than assumed low or high. The vuln.today decision label is 'this_month', consistent with a medium flaw that has a vendor patch but no confirmed in-the-wild use. Net: a genuine privilege-boundary-crossing bug (mailbox user → admin context) worth remediating on a routine monthly cycle, gated by the need for a valid account, the TOTP feature being enabled, and an admin actually opening the exceptions page.

An authenticated low-privilege mailbox user creates a TOTP exception whose description field contains a script payload, which is stored unescaped in the database. When a global administrator later opens totp-exceptions.php, the payload executes in the admin's authenticated browser session and can issue admin-level requests reusing the page's CSRF token, effectively escalating a mailbox user toward administrative actions. No confirmed working public exploit is identified in the input, though VulnCheck published an advisory and the GitHub issue (#1185) documents the flaw.