CVE-2026-120330: fallo de gravedad alta en TYPO3 Extension "Mail"
Broken Access Control in extension "Mail" (mail)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
TYPO3 · Extension "Mail"CVEs relacionadas — TYPO3 Extension "Mail"
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-120328MEDIUMInformation Disclosure in extension "Mail" (mail)EPSS 0.4%CVE-2026-120327MEDIUMOpen Redirection in extension "Mail" (mail)EPSS 0.3%CVE-2026-120329MEDIUMBroken Access Control in extension "Mail" (mail)EPSS 0.3%CVE-2026-120332MEDIUMCross-Site Scripting in extension "Mail" (mail)EPSS 0.3%CVE-2026-120331MEDIUMServer-Side Request Forgery in extension "Mail" (mail)EPSS 0.3%