# CVE-2026-50591: Znuny stored XSS in user preferences

Source: https://junglewise.ai/threats/cve-2026-50591-znuny-stored-xss-in-user-preferences  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-50591 · Severity: medium · CVSS 5.4 · Published 2026-06-05

Znuny, an open-source help desk and ticketing system, is vulnerable to a security flaw where malicious code can be saved within a user's account settings. If an attacker successfully saves this code, it could execute in the browser of another user or administrator who views those settings. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: [Znuny](https://junglewise.ai/threats/technologies/znuny), [Znuny LTS](https://junglewise.ai/threats/technologies/znuny-lts). Vendors: [Znuny](https://junglewise.ai/threats/vendors/znuny).

## Quick answers

**Is CVE-2026-50591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50591 being exploited in the wild.

**How severe is CVE-2026-50591?** Medium severity, with a CVSS score of 5.4, published 5 June 2026.

**Which products and versions are affected?** Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 6.5.1 through 6.5.20; Znuny LTS 6.0, 6.1, 6.2, 6.3, 6.4, 6.5.1 through 6.5.20.

**Is there a fix for CVE-2026-50591?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50591 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50591?** Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Znuny due to improper output encoding of user preferences stored in the database. An authenticated attacker with low privileges can inject malicious JavaScript into preference fields. When these values are subsequently rendered in the web interface for another user (such as an administrator), the script executes within the security context of that user's session. This is tracked as CWE-79 and requires the victim to view the affected preference page. The issue is resolved in Znuny LTS 6.5.21 and Znuny 7.3.3.

## Affected products

- Znuny Znuny LTS 6.0, 6.1, 6.2, 6.3, 6.4, 6.5.1 through 6.5.20
- Znuny Znuny 7.0, 7.1, 7.2, 7.3.1 through 7.3.2

## Timeline

- 2026-05-27: advisory: Vendor advisory ZSA-2026-11 released
- 2026-06-05: disclosed: CVE-2026-50591 published

## References

- [https://www.znuny.org/en/advisories/zsa-2026-11](https://www.znuny.org/en/advisories/zsa-2026-11)

## Related threats

- [Znuny HTTPBasicAuth header spoofing authentication bypass](https://junglewise.ai/threats/cve-2026-93483-in-znuny-through-7-3-6-an-attacker-can-bypass-specific-standard)
- [Znuny AgentTicketEmailResend template XSS](https://junglewise.ai/threats/cve-2026-77506-znuny-agentticketemailresend-template-xss)
- [Znuny reflected XSS in AdminCommunicationLog](https://junglewise.ai/threats/cve-2026-50592-znuny-reflected-xss-in-admincommunicationlog)
- [Znuny reflected XSS in customer.pl OTRSCustomerInterface parameter](https://junglewise.ai/threats/cve-2025-52204-znuny-reflected-xss-in-customer-pl-otrscustomerinterface)