CVE-2026-120328Information Disclosure in extension "Mail" (mail)

Descripción

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory