---
id: "CVE-2026-120329"
kind: "vulnerability"
aliases: ["CVE-2026-120329"]
title: "TYPO3 mail module lets backend users write arbitrary page TSconfig"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cms", "php", "runtime", "self-hosted", "typo3"]
not_affected_if: ["frontend-only", "no-mail-module-access"]
published_at: "2026-11-03T10:17:17+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:20:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120329", "first_seen_at": "2026-11-03T10:20:16+00:00"}]
---

# TYPO3 mail module lets backend users write arbitrary page TSconfig

Saving the mail backend module's configuration writes submitted settings into page TSconfig without limiting them to the module's own options. A backend user with access to the mail module can therefore write arbitrary page TSconfig.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the TYPO3 version in use, for example with `vendor/bin/typo3 --version` or the Composer lock file.
- Check whether the mail module is installed and whether backend users with mail access exist.

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120329

## From the sources

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_