CVE-2026-120328— Information Disclosure in extension "Mail" (mail)

Quick assessment

Affected

TYPO3 Extension "Mail"

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

点击跟踪中间件在认证码被省略时，未对收件人的认证码进行验证。未认证的攻击者可以获取插入到已发送邮件链接中的新闻通讯收件人的个人数据。

CVSS 6.9 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Information Disclosure in extension "Mail" (mail)

Source: CVE Program / CVE List V5

Vulnerability Description

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
TYPO3	Extension "Mail"	4.0.0 ~ 4.2.0	-

II. Public POCs for CVE-2026-120328

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120328

请登录查看更多情报信息。

Other References for CVE-2026-120328 (1)

https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120328

Same Patch Batch · TYPO3 · 2026-11-03 · 7 CVEs total

CVE-2026-120333	8.8 HIGH	Broken Access Control in extension "Frontend User Registration" (sf_register)
CVE-2026-120330	7.1 HIGH	Broken Access Control in extension "Mail" (mail)
CVE-2026-120327	5.3 MEDIUM	Open Redirection in extension "Mail" (mail)
CVE-2026-120329	5.3 MEDIUM	Broken Access Control in extension "Mail" (mail)
CVE-2026-120331	5.3 MEDIUM	Server-Side Request Forgery in extension "Mail" (mail)
CVE-2026-120332	5.1 MEDIUM	Cross-Site Scripting in extension "Mail" (mail)

IV. Related Vulnerabilities

Same product: Extension "Mail"

Same vendor: TYPO3

Same weakness: CWE-639