CVE-2026-120328Information Disclosure in extension "Mail" (mail)

Beschreibung

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory