CVE-2026-104808: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Mitel Mitel MiVoice Office 400

This vulnerability is a stored XSS flaw (CWE-79) in the Mitel MiVoice Office 400 web portal, specifically in the Microsoft Exchange mailbox field under Configuration → Users → Users List. The field does not properly validate or sanitize input before storing and rendering it, allowing an authenticated malicious user to inject persistent JavaScript or HTML content. When the affected user properties are viewed, the injected script executes, potentially causing denial-of-service by blocking access to user properties within the application.

An authenticated attacker can exploit this vulnerability to inject persistent malicious scripts that execute in the context of the web application. This results in a denial-of-service condition affecting the user-management functionality by preventing access to the affected user properties. The CVSS 4.0 base score is low (1.9), reflecting limited impact and the requirement for authentication and user interaction.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users and monitor for suspicious activity related to user property modifications.