{"id":"CVE-2026-120329","kind":"vulnerability","aliases":["CVE-2026-120329"],"related":[],"title":"TYPO3 mail module lets backend users write arbitrary page TSconfig","description":"Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.","summary":"Saving the mail backend module's configuration writes submitted settings into page TSconfig without limiting them to the module's own options. A backend user with access to the mail module can therefore write arbitrary page TSconfig.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","php","runtime","self-hosted","typo3"],"not_affected_if":["frontend-only","no-mail-module-access"],"how_to_check":"- Confirm the TYPO3 version in use, for example with `vendor/bin/typo3 --version` or the Composer lock file.\n- Check whether the mail module is installed and whether backend users with mail access exist.","fix":null,"status":"open","published_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","triaged_at":"2026-11-03T10:20:40+00:00","updated_at":"2026-11-03T10:20:40+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T10:20:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TYPO3 mail module lets backend users write arbitrary page TSconfig","impact":"medium","summary":"Saving the mail backend module's configuration writes submitted settings into page TSconfig without limiting them to the module's own options. A backend user with access to the mail module can therefore write arbitrary page TSconfig.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["typo3","php","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"backend user alters page TSconfig beyond the mail module","analyst_note":"Sources give no affected or fixed TYPO3 versions; check the NVD entry and the TYPO3 security bulletin for ranges and patched releases.","how_to_check":"- Confirm the TYPO3 version in use, for example with `vendor/bin/typo3 --version` or the Composer lock file.\n- Check whether the mail module is installed and whether backend users with mail access exist.","plain_action":"","needs_analyst":true,"not_affected_if":["no-mail-module-access","frontend-only"],"who_is_affected":"Sites running the TYPO3 CMS with the mail backend module, where some backend editors have access to that module. Exposure depends on which backend users are allowed into it. unknown for affected version ranges.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":4088,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120329':13A,16A '-2026':12A,15A 'access':50B,89C 'arbitrari':8A,58B,96C 'backend':5A,27B,47B,67C,86C 'cms':17B 'configur':30B,63C,81C 'cve':11A,14A 'host':22B 'let':4A 'limit':38B 'mail':2A,26B,53B,66C,92C 'modul':3A,28B,42B,54B,68C,85C,93C 'option':45B,82C 'page':9A,35B,59B,74C,97C 'php':18B 'restrict':77C 'runtim':19B 'save':24B,61C 'self':21B 'self-host':20B 'set':33B,71C 'submit':32B,70C 'therefor':56B 'tsconfig':10A,36B,60B,75C,98C 'typo3':1A,23B 'user':6A,48B,87C 'without':37B,76C 'write':7A,31B,57B,69C,95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TYPO3 CMS with the mail backend module, where some backend editors have access to that module. Exposure depends on which backend users are allowed into it. unknown for affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","php","runtime","selfhosted","typo3"],"first_public_at":"2026-11-03T10:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120329","severity":null,"published_at":"2026-11-03T10:17:17+00:00","modified_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","fetched_at":"2026-11-03T10:20:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}