Live › vulnerability › CVE-2026-120330
The mail module's backend actions and AJAX routes skip the check that a backend user can access the page a mail or recipient group belongs to. A backend user with mail module access can view, change, send and export mails and recipient groups outside their web mounts, including recipients' personal data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Sites running the TYPO3 mail module where backend users have mail module access but are restricted to certain web mounts. The exposure depends on that restriction, and installations without mail module access for limited editors are less exposed. unknown for the exact affected versions.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
This page as .md · .json · in your agent: get_signal("CVE-2026-120330")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.