Stored XSS Vulnerability in Znuny Product
CVE-2026-50591

5.4MEDIUM

Key Information:

Vendor

Znuny

Status
Znuny
Vendor
CVE Published:
5 June 2026

What is CVE-2026-50591?

A vulnerability exists in Znuny LTS versions prior to 6.5.21 and Znuny versions prior to 7.3.3, where Cross-Site Scripting (XSS) can be exploited through stored user preferences. This issue allows an attacker to inject malicious scripts that are executed in the context of another user when they access the compromised user preferences, potentially compromising user accounts and sensitive data.

Affected Version(s)

Znuny 6.0.0 < 6.5.21

Znuny 7.0.0 < 7.3.3

References

https://www.znuny.org/en/advisories/zsa-2026-11

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.