CVE-2026-123622: Usermin through 2.570 XSS via mailbox detach.cgi type Parameter
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Usermin deployments through version 2.570 are exposed when users can receive email with HTML attachments and can be persuaded to open a crafted detach.cgi link while authenticated to Usermin.
What does an attacker need to exploit it?
The attacker needs to send an HTML attachment containing script and lure a recipient to a detach.cgi URL using type=text/html. The script executes in the recipient's authenticated Usermin session.
How can I determine whether my installation is affected?
Installations running Usermin 2.570 or earlier are within the affected version range. The vulnerable handling is in mailbox/detach.cgi when the type parameter can be supplied as text/html.