{"id":"CVE-2026-118495","kind":"vulnerability","aliases":["CVE-2026-118495"],"related":[],"title":"AcyMailing: unauthenticated lookup exposes subscriber keys, enabling account actions","description":"Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled.","summary":"AcyMailing, a mailing-list extension for Joomla and WordPress, lets an unauthenticated attacker read a subscriber's record by knowing their email address. The record includes a per-subscriber secret key, which lets the attacker act as that subscriber, including triggering GDPR data export and account deletion where those options are enabled.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acymailing","joomla","mailing-list","package","wordpress"],"not_affected_if":["no-acymailing","version-outside-range"],"how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager against the affected range `6.0.0` through `11.1.1`.\n- Confirm whether GDPR export or deletion options are enabled in AcyMailing's settings.","fix":"- AcyMailing versions `6.0.0` through `11.1.1` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-12T18:17:16+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:40+00:00","updated_at":"2026-11-12T18:42:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T18:42:40Z","model":"claude-haiku-5-5","output":{"fix":"- AcyMailing versions `6.0.0` through `11.1.1` are affected; the sources do not name a fixed version.","reach":"internet","title":"AcyMailing: unauthenticated lookup exposes subscriber keys, enabling account actions","impact":"medium","summary":"AcyMailing, a mailing-list extension for Joomla and WordPress, lets an unauthenticated attacker read a subscriber's record by knowing their email address. The record includes a per-subscriber secret key, which lets the attacker act as that subscriber, including triggering GDPR data export and account deletion where those options are enabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["acymailing","joomla","wordpress","mailing-list"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker acts as any subscriber, deleting accounts or exporting data","analyst_note":"Confirm the fixed version and whether the GDPR endpoints are on by default; the NVD entry gives no fix.","how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager against the affected range `6.0.0` through `11.1.1`.\n- Confirm whether GDPR export or deletion options are enabled in AcyMailing's settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-acymailing"],"who_is_affected":"Sites running AcyMailing versions 6.0.0 through 11.1.1 as a Joomla or WordPress extension are exposed. The attacker needs only a subscriber's email address, and the impact is strongest where GDPR export or deletion is enabled. Sites on other versions, or without AcyMailing, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4668,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118495':12A,15A '-2026':11A,14A '11.1.1':92C,105C '6.0.0':91C,103C 'account':8A,70B,158C 'act':60B,141C 'action':9A 'actor':88C,100C 'acymail':1A,16B,23B,90C,102C 'acymailing.com':80C 'address':46B,115C 'attack':36B,59B,108C,139C 'authoris':130C 'cve':10A,13A 'data':67B,153C 'delet':71B,159C 'email':45B,114C 'enabl':7A,76B,164C 'endpoint':147C 'export':68B,154C 'expos':4A 'exposur':81C,93C 'extens':28B,79C 'gdpr':66B,152C,157C 'hold':135C 'includ':49B,64B,122C,149C 'inform':84C,96C 'joomla':17B,30B,77C 'key':6A,55B,128C,137C 'know':43B,110C 'let':33B,57B 'link':134C 'list':20B,27B 'lookup':3A 'mail':19B,26B 'mailing-list':18B,25B 'manag':133C 'option':74B,162C 'packag':21B 'per':52B,125C 'per-subscrib':51B,124C 'read':37B,117C 'record':41B,48B,121C 'secret':54B,127C 'sensit':83C,95C 'subscrib':5A,39B,53B,63B,112C,119C,126C,144C 'subscript':132C 'trigger':65B,150C 'unauthent':2A,35B,107C 'unauthor':87C,99C 'wordpress':22B,32B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running AcyMailing versions 6.0.0 through 11.1.1 as a Joomla or WordPress extension are exposed. The attacker needs only a subscriber's email address, and the impact is strongest where GDPR export or deletion is enabled. Sites on other versions, or without AcyMailing, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acymailing","high","joomla","mailinglist","package","wordpress"],"campaign_type":null,"search_a":"'-118495':12A,15A '-2026':11A,14A 'account':8A 'action':9A 'acymail':1A 'cve':10A,13A 'enabl':7A 'expos':4A 'key':6A 'lookup':3A 'subscrib':5A 'unauthent':2A","search_b":"'account':70B 'act':60B 'acymail':16B,23B 'address':46B 'attack':36B,59B 'data':67B 'delet':71B 'email':45B 'enabl':76B 'export':68B 'extens':28B 'gdpr':66B 'includ':49B,64B 'joomla':17B,30B 'key':55B 'know':43B 'let':33B,57B 'list':20B,27B 'mail':19B,26B 'mailing-list':18B,25B 'option':74B 'packag':21B 'per':52B 'per-subscrib':51B 'read':37B 'record':41B,48B 'secret':54B 'subscrib':39B,53B,63B 'trigger':65B 'unauthent':35B 'wordpress':22B,32B","search_c":"'11.1.1':92C,105C '6.0.0':91C,103C 'account':158C 'act':141C 'actor':88C,100C 'acymail':90C,102C 'acymailing.com':80C 'address':115C 'attack':108C,139C 'authoris':130C 'data':153C 'delet':159C 'email':114C 'enabl':164C 'endpoint':147C 'export':154C 'exposur':81C,93C 'extens':79C 'gdpr':152C,157C 'hold':135C 'includ':122C,149C 'inform':84C,96C 'joomla':77C 'key':128C,137C 'know':110C 'link':134C 'manag':133C 'option':162C 'per':125C 'per-subscrib':124C 'read':117C 'record':121C 'secret':127C 'sensit':83C,95C 'subscrib':112C,119C,126C,144C 'subscript':132C 'trigger':150C 'unauthent':107C 'unauthor':87C,99C 'wordpress':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118495","severity":null,"published_at":"2026-11-12T18:17:16+00:00","modified_at":"2026-11-12T18:17:16+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}