CVE-2026-50591: Stored XSS in Znuny User Preferences – CVSS 5.4 Analysis & Patch Guide

Technical summary

CVE-2026-50591 is a stored XSS vulnerability (CWE-79) in Znuny's user preference functionality. The vulnerability allows authenticated users to inject unsanitized JavaScript into preference fields that persist in the application database. When other users access the affected user's profile or related interface elements, the malicious script executes in their session context with their privileges. The attack vector is network-based, requires valid authentication, and depends on user interaction. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for authentication and user interaction, which constrains the practical impact despite the vulnerability's cross-site nature.

Business impact

For organizations running Znuny as their service desk or ticketing backbone, this vulnerability creates operational and trust risks. Malicious insiders or compromised user accounts can silently harvest session tokens, modify ticket data, or redirect support staff to phishing pages—all without triggering alerts. Reputational damage occurs if support staff or customers discover injected content. The vulnerability requires no special access tier, meaning any authenticated user (including low-privilege support agents) becomes a potential attack surface. Affected organizations face the need to audit user preference fields across their Znuny deployment, reset compromised sessions, and validate patch readiness before production deployment.

Affected systems

Znuny LTS (long-term support) versions prior to 6.5.21 and Znuny standard versions prior to 7.3.3 are vulnerable. Organizations should verify their exact installed version in the system configuration or admin panel. Znuny LTS users are typically on longer release cycles, so patch availability may differ from standard branch timelines. Community and commercial Znuny deployments are both affected.

Exploitability

Exploitability is moderate. An attacker must possess valid login credentials—either through social engineering, compromised accounts, or insider access. Once authenticated, injecting malicious JavaScript into user preference fields requires no special privileges or additional bypasses. However, exploitation depends on a second user (a colleague or manager) visiting the attacker's profile or preference page, which is expected behavior in most ticketing workflows but not guaranteed. The low barrier to execution for authenticated users makes this a credible insider threat and a concern for organizations with weak password policies or exposed credentials.

Remediation

Upgrade Znuny LTS installations to version 6.5.21 or later, and upgrade standard Znuny to version 7.3.3 or later. These versions include input validation and output encoding fixes for user preference fields. Organizations should plan upgrades during low-traffic windows, as ticketing system downtime can disrupt support operations. Before patching, consider disabling or restricting user preference modification via access controls if your Znuny deployment allows it. Test patches in a staging environment to confirm compatibility with custom modules or integrations.

Patch guidance

Verify your Znuny version in the admin panel (System → System Information). For Znuny LTS users on 6.0.x–6.5.20, update to 6.5.21. For standard branch users on 7.0.x–7.3.2, update to 7.3.3. Consult the official Znuny release notes and security advisories for your branch to confirm patch availability and any configuration migration steps. If you maintain custom modules that interact with user preferences, test them thoroughly post-upgrade to ensure they respect the new validation logic. Plan a staged rollout if managing multiple Znuny instances.

Detection guidance

Monitor for suspicious stored data in user preference fields (database tables related to user settings). Search application logs for unusually high rates of user preference modifications, especially by accounts with low activity history. Deploy a Web Application Firewall (WAF) rule to detect JavaScript patterns in HTTP requests targeting preference endpoints. Query your Znuny database for script tags or encoded JavaScript in preference fields—sanitized content should not contain HTML entities like `<script>`, `onerror=`, or `onclick=`. Endpoint Detection & Response (EDR) tools on staff workstations can flag unexpected script execution originating from the Znuny domain. If available, enable Znuny audit logging for preference changes and correlate with user login times.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), organizational context elevates priority. Service desk systems are high-trust environments where phishing and credential theft directly compromise customer-facing operations. Insider risk is non-trivial in IT departments, and the low barrier to exploitation for any authenticated user increases likelihood. The stored nature of the XSS means a single injection can affect multiple users over time, making cleanup and forensics harder. Organizations should prioritize patching based on their user base size and the sensitivity of tickets handled; those managing financial, healthcare, or personnel data face greater risk.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a MEDIUM severity: network-accessible, low complexity, but requiring authentication and user interaction. The score appropriately penalizes exploitation for these constraints. However, the score does not account for the organizational trust level of ticketing systems or the reputational/operational impact of a compromised support desk. Security teams should apply their own risk multiplier based on the role of Znuny in their infrastructure and the sensitivity of data it processes.

Frequently asked questions