CVE-2026-57322 is an unauthenticated cross-site scripting (XSS) vulnerability affecting weDevs weMail software versions up to 2.1.2. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability allows an attacker to inject malicious scripts that could execute in the context of the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope change. As of the published date, no vendor patch or official remediation has been disclosed.

The vulnerability enables an attacker to perform cross-site scripting attacks without authentication, which can lead to partial disclosure of information (confidentiality impact), modification of data or execution of unauthorized actions (integrity impact), and disruption of service (availability impact). The scope of impact extends beyond the vulnerable component, indicating potential broader effects on the application or system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying temporary mitigations such as input validation or output encoding where feasible. Monitor official vendor channels for updates.