Vulnerability · Published Nov 3, 2026 · Assigned by TYPO3
CVE-2026-120329Broken Access Control in extension "Mail" (mail)
Medium 5.3
In plain English
A medium-severity injection in Extension "Mail" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "Mail" | 4.0.0 – before 4.2.00 – before 3.12.5 |
Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory