CVE-2026-120328 Details
Description
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
A vulnerability exists in the TYPO3 Mail extension, specifically in versions 3.12.4 and earlier, as well as 4.0.0 to 4.1.0. The issue arises in the click tracking middleware, which fails to validate the authentication code of newsletter recipients when the code is not provided. This oversight allows unauthenticated attackers to access personal data of newsletter recipients, as this information is embedded in the links of the emails sent.
Users of the TYPO3 Mail extension are advised to update to version 3.12.5 or 4.2.0, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-037 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Mail | <= 3.12.4 (semver) >= 4.0.0, <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | TYPO3 |