CVE-2026-120327 Details
Description
The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.
A vulnerability allowing open redirection has been identified in the TYPO3 Mail extension, versions 3.12.4 and below, as well as 4.0.0 to 4.1.0. The issue arises from the click tracking middleware, which accepts arbitrary target URLs and redirects users to them. This flaw can be exploited to redirect users to external sites.
Users are advised to update to TYPO3 Mail extension versions 3.12.5 or 4.2.0, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-037 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Mail | <= 3.12.4 (semver) >= 4.0.0, <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | TYPO3 |