CVE-2026-120329: medium-severity vulnerability in TYPO3 Extension "Mail"
Broken Access Control in extension "Mail" (mail)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "Mail"Related CVEs — TYPO3 Extension "Mail"
In the same product, most dangerous first.
CVE-2026-120328MEDIUMInformation Disclosure in extension "Mail" (mail)EPSS 0.4%CVE-2026-120330HIGHBroken Access Control in extension "Mail" (mail)EPSS 0.4%CVE-2026-120327MEDIUMOpen Redirection in extension "Mail" (mail)EPSS 0.3%CVE-2026-120332MEDIUMCross-Site Scripting in extension "Mail" (mail)EPSS 0.3%CVE-2026-120331MEDIUMServer-Side Request Forgery in extension "Mail" (mail)EPSS 0.3%