CVE-2026-50592: Znuny AdminCommunicationLog XSS Flaw

CVE-2026-50592 Overview

CVE-2026-50592 is a reflected cross-site scripting (XSS) vulnerability in Znuny, an open-source service management and ticketing platform. The flaw exists in the AdminCommunicationLog view, also known as the communication log administration interface. Znuny Long-Term Support (LTS) versions before 6.5.21 and Znuny versions before 7.3.3 are affected. An authenticated administrator user can be tricked into rendering attacker-controlled script content in the browser context of the Znuny application. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated admin session, leading to session compromise and unauthorized actions within Znuny.

Affected Products

Znuny LTS versions before 6.5.21
Znuny versions before 7.3.3
AdminCommunicationLog administration view component

Discovery Timeline

2026-06-05 - CVE-2026-50592 published to the National Vulnerability Database (NVD)
2026-06-05 - Last updated in the NVD database

Technical Details for CVE-2026-50592

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the AdminCommunicationLog administration view of Znuny. Reflected XSS occurs when an application echoes attacker-supplied input directly into HTML output without proper neutralization. In this case, parameters processed by the communication log administration view are rendered into the response without sufficient encoding or sanitization.

An attacker crafts a malicious URL containing JavaScript payloads. When an authenticated administrator clicks the link, the payload executes in the browser under the Znuny application origin. The attacker gains the ability to manipulate the DOM, exfiltrate session tokens, perform privileged ticketing actions, or pivot into further administrative operations.

The CWE-79 classification confirms the root issue is improper output neutralization. Exploitation requires user interaction is not needed at the protocol level, but the victim must visit the crafted URL while authenticated to Znuny.

Root Cause

The root cause is missing or insufficient output encoding when rendering user-supplied parameters into the AdminCommunicationLog HTML response. Untrusted input flows from request parameters directly into the rendered template, allowing HTML and JavaScript constructs to break out of intended data contexts.

Attack Vector

The attack vector is network-based and targets authenticated administrative users. An attacker delivers a crafted URL through phishing, chat, ticket content, or any channel reachable by the target. When the administrator follows the link in an authenticated session, the script executes against the Znuny origin. The scope change in the CVSS vector indicates the impact extends beyond the vulnerable component into other parts of the application.

No verified public exploit code is available. Refer to the Znuny Security Advisory ZSA-2026-10 for vendor-provided technical context.

Detection Methods for CVE-2026-50592

Indicators of Compromise

HTTP GET requests to AdminCommunicationLog containing URL-encoded <script>, onerror=, javascript:, or similar JavaScript constructs in query parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after a session in Znuny.
Unusual administrative actions (user creation, permission changes) originating from legitimate admin accounts without corresponding user activity.

Detection Strategies

Inspect web server and reverse proxy access logs for requests to AdminCommunicationLog containing script-like patterns or HTML entities in parameters.
Deploy a web application firewall (WAF) rule set that flags reflected XSS payloads targeting Znuny administrative endpoints.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution attempts on Znuny pages.

Monitoring Recommendations

Alert on any HTTP 200 response from AdminCommunicationLog where the response body contains reflected query parameter values without encoding.
Correlate administrator login events with subsequent navigation to externally referred URLs containing the AdminCommunicationLog path.
Track session token usage across IP addresses to identify session hijacking attempts following suspected XSS execution.

How to Mitigate CVE-2026-50592

Immediate Actions Required

Upgrade Znuny LTS deployments to version 6.5.21 or later and Znuny standard releases to 7.3.3 or later.
Restrict access to the Znuny administrative interface to trusted networks using firewall rules or reverse proxy ACLs.
Instruct administrators to avoid clicking unsolicited links that reference Znuny URLs, especially AdminCommunicationLog.

Patch Information

Znuny addressed the vulnerability in LTS release 6.5.21 and standard release 7.3.3. Review the Znuny Security Advisory ZSA-2026-10 for full patch details and upgrade instructions. Apply the vendor-supplied update through the standard Znuny upgrade process.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the Znuny origin.
Deploy WAF rules to block requests to AdminCommunicationLog containing script tags, event handler attributes, or javascript: URIs.
Require administrators to use a dedicated browser profile or session for Znuny administration to limit cross-site exposure.

bash

# Example NGINX reverse proxy rule to block obvious XSS payloads to AdminCommunicationLog
location ~* /index\.pl {
    if ($args ~* "Action=AdminCommunicationLog.*(<script|onerror=|javascript:)") {
        return 403;
    }
    proxy_pass http://znuny_backend;
}