Vulnerability · Published Nov 3, 2026 · Assigned by TYPO3
CVE-2026-120330Broken Access Control in extension "Mail" (mail)
High 7.1
In plain English
A high-severity missing authorization in Extension "Mail" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "Mail" | 4.0.0 – before 4.2.00 – before 3.12.5 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-037 vendor-advisory