CVE-2026-93641

Summary

This flaw allows unauthenticated attackers to forge a share notification, leading to stored cross-site scripting (XSS) when a signed-in user clicks on it, granting the attacker access to the victim's mailbox data.

Exploitability

Exploitation is relatively straightforward as it requires only the forging of a share notification, which can be done with minimal effort.

Blast radius

If exploited, the attacker can access the victim's mailbox data and potentially act as the victim, leading to significant data exposure and privacy breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Accept Share feature or restrict access to the feature to authenticated users only.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.