{"id":"CVE-2026-120328","kind":"vulnerability","aliases":["CVE-2026-120328"],"related":[],"title":"Click tracking middleware skips recipient code check, exposing newsletter recipient data","description":"The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.","summary":"The click tracking middleware does not validate a recipient's authentication code when that code is left out of a request. An unauthenticated attacker can retrieve personal data of newsletter recipients that is embedded in the links of sent mails.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-marketing","newsletter","package","self-hosted"],"not_affected_if":["no-click-tracking","no-newsletter-software"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","triaged_at":"2026-11-03T10:20:36+00:00","updated_at":"2026-11-03T10:20:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T10:20:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Click tracking middleware skips recipient code check, exposing newsletter recipient data","impact":"medium","summary":"The click tracking middleware does not validate a recipient's authentication code when that code is left out of a request. An unauthenticated attacker can retrieve personal data of newsletter recipients that is embedded in the links of sent mails.","audience":"businesses","category":"package","nicknames":[],"who_cares":["newsletter","email-marketing","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads personal data of newsletter recipients without logging in","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120328 and find the vendor fix.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-click-tracking","no-newsletter-software"],"who_is_affected":"Applies to a newsletter or mailing software whose click tracking middleware is reachable from the internet. The sources do not name the product or the affected versions, so the exact exposure is unknown. Teams that do not run a newsletter tool with click tracking can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":4087,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120328':14A,17A '-2026':13A,16A 'attack':49B,85C 'authent':36B,74C 'check':7A 'click':1A,27B,67C 'code':6A,37B,40B,75C,81C 'cve':12A,15A 'data':11A,53B,89C 'email':19B 'email-market':18B 'embed':59B 'expos':8A 'host':25B 'insert':95C 'left':42B 'link':62B,97C 'mail':65B,100C 'market':20B 'middlewar':3A,29B,69C 'newslett':9A,21B,55B,91C 'omit':83C 'packag':22B 'person':52B,88C 'recipi':5A,10A,34B,56B,78C,92C 'request':46B 'retriev':51B,87C 'self':24B 'self-host':23B 'sent':64B,99C 'skip':4A 'track':2A,28B,68C 'unauthent':48B,84C 'valid':32B,72C","nicknames":[],"mitigations":[],"who_affected":"Applies to a newsletter or mailing software whose click tracking middleware is reachable from the internet. The sources do not name the product or the affected versions, so the exact exposure is unknown. Teams that do not run a newsletter tool with click tracking can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailmarketing","medium","newsletter","package","selfhosted"],"first_public_at":"2026-11-03T10:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120328","severity":null,"published_at":"2026-11-03T10:17:17+00:00","modified_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","fetched_at":"2026-11-03T10:20:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}