Live › vulnerability › CVE-2026-120328
The click tracking middleware does not validate a recipient's authentication code when that code is left out of a request. An unauthenticated attacker can retrieve personal data of newsletter recipients that is embedded in the links of sent mails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Applies to a newsletter or mailing software whose click tracking middleware is reachable from the internet. The sources do not name the product or the affected versions, so the exact exposure is unknown. Teams that do not run a newsletter tool with click tracking can likely skip it.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
This page as .md · .json · in your agent: get_signal("CVE-2026-120328")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.