Znuny CVE-2026-50592

The attacker must hold a valid Znuny account with at least low-level privileges (PR:L confirmed by CVSS vector). The vulnerable component is the AdminCommunicationLog view - exploitation requires that this administrative view is accessible and that a more privileged user (such as an administrator) can be induced to load a crafted URL pointing to it. Exploitation is limited by the requirement for an authenticated session (unauthenticated external attackers cannot exploit this directly) and by the need to deliver a malicious link to a target with sufficient privilege to access the admin view. The UI:N designation in the CVSS vector conflicts with the reflected XSS class and should be independently verified - if UI:R is correct, the attack additionally requires the privileged victim to follow or render the attacker-supplied link.

The CVSS 6.4 score is driven by AV:N (network-accessible), AC:L (no special conditions), PR:L (low-privilege authentication required), S:C (changed scope), with C:L and I:L impacts. A notable discrepancy exists in the scoring: the vulnerability is described as reflected XSS, which canonically requires victim interaction with a malicious link (UI:R), yet the CVSS vector specifies UI:N (no user interaction). Security teams should verify this with the vendor advisory at znuny.org/en/advisories/zsa-2026-10, as this inconsistency affects exploitability assessment. If UI should be R, the effective CVSS would be lower (~5.4 range). No EPSS data was provided, no KEV listing exists, and no POC is known, suggesting no confirmed widespread exploitation. Real-world risk is moderate: exploitation requires a low-privileged account and the ability to deliver a crafted URL to a more privileged user (e.g., an admin), which is a realistic internal threat scenario in multi-tenant or shared helpdesk environments.

A low-privileged Znuny agent account crafts a malicious URL targeting the AdminCommunicationLog view with an injected JavaScript payload in a reflected parameter, then delivers that URL to a Znuny administrator via an internal ticket comment, email, or chat message. When the administrator loads the URL, the script executes in their browser session, potentially enabling session token theft, unauthorized administrative actions, or further lateral movement within the application. No public POC exists at time of analysis, but the attack pattern is well-understood and low-complexity.