CVE-2026-120328: falha de média gravidade em TYPO3 Extension "Mail"
Information Disclosure in extension "Mail" (mail)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TYPO3 · Extension "Mail"CVEs relacionadas — TYPO3 Extension "Mail"
No mesmo produto, das mais perigosas para as menos.
CVE-2026-120330HIGHBroken Access Control in extension "Mail" (mail)EPSS 0.4%CVE-2026-120327MEDIUMOpen Redirection in extension "Mail" (mail)EPSS 0.3%CVE-2026-120329MEDIUMBroken Access Control in extension "Mail" (mail)EPSS 0.3%CVE-2026-120332MEDIUMCross-Site Scripting in extension "Mail" (mail)EPSS 0.3%CVE-2026-120331MEDIUMServer-Side Request Forgery in extension "Mail" (mail)EPSS 0.3%