# CVE-2026-123622: Usermin cross-site scripting in mailbox attachment handling

Source: https://junglewise.ai/threats/cve-2026-123622-usermin-through-2-570-contains-a-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123622 · Severity: medium · CVSS 6.1 · Published 2026-11-06

Usermin is a web-based email and system administration interface for end users. A cross-site scripting vulnerability in the mailbox attachment viewer allows attackers to execute arbitrary JavaScript in an authenticated user's browser session by sending a malicious HTML attachment and tricking the user to open it with a crafted link. This could lead to session hijacking, email theft, or other account compromise.

Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-123622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123622 being exploited in the wild.

**How severe is CVE-2026-123622?** Medium severity, with a CVSS score of 6.1, published 6 November 2026.

**Which products and versions are affected?** Webmin Usermin through 2.570.

**Is there a fix for CVE-2026-123622?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123622 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123622?** Check whether you run Webmin Usermin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in mailbox/detach.cgi where the type parameter bypasses JavaScript filtering protections. When an attacker supplies type=text/html, the script skips the filter_javascript() call that would normally sanitize HTML content, directly outputting the attachment data. The attack requires the victim to be authenticated in Usermin and to click a malicious link crafted by the attacker.

## Affected products

- Webmin Usermin through 2.570

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/webmin/usermin](https://github.com/webmin/usermin)
- [https://github.com/webmin/usermin/blob/2.570/mailbox/detach.cgi](https://github.com/webmin/usermin/blob/2.570/mailbox/detach.cgi)

## Related threats

- [Usermin command injection in Read Mail module](https://junglewise.ai/threats/cve-2026-123620-usermin-through-2-570-contains-an-os-command-injection)