CVE-2026-50591
Deferred Deferred - Pending Action
Stored XSS in Znuny LTS and Znuny via User Preferences

Publication date: 2026-06-05

Last updated on: 2026-06-05

Assigner: MITRE

Description
IN Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-05
Generated
2026-06-25
AI Q&A
2026-06-05
EPSS Evaluated
2026-06-24
NVD
CVE-2026-50591
EUVD
EUVD-2026-34782
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
znuny znuny to 7.3.2 (inc)
znuny znuny to 6.5.20 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue found in Znuny versions before 6.5.21 (LTS) and before 7.3.3 (standard releases). It occurs because user preferences are stored in the database without proper output encoding. When these stored preferences are viewed in a user's browser session, malicious JavaScript code can execute.

Impact Analysis

This vulnerability can allow an attacker to execute malicious JavaScript in the context of a user's browser session. This can lead to unauthorized actions such as stealing user credentials, hijacking sessions, or performing actions on behalf of the user without their consent. The vulnerability has a medium severity rating.

Detection Guidance

This vulnerability is a stored Cross-Site Scripting (XSS) issue involving user preferences stored in the database and executed in the user's browser. Detection typically involves inspecting stored user preference data for malicious JavaScript payloads.

There are no specific commands provided in the available resources to detect this vulnerability on your network or system.

Mitigation Strategies

The immediate mitigation step is to upgrade Znuny to version 6.5.21 or later for LTS releases, or to version 7.3.3 or later for standard releases, where this vulnerability has been fixed.

Until the upgrade can be performed, consider reviewing and sanitizing stored user preferences to remove any malicious scripts, and restrict user input where possible to reduce the risk of stored XSS.

Compliance Impact

The provided information does not specify how the stored XSS vulnerability in Znuny affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart