{"id":"CVE-2026-120330","kind":"vulnerability","aliases":["CVE-2026-120330"],"related":[],"title":"TYPO3 mail module lets backend users reach mails outside their page access","description":"Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.","summary":"The mail module's backend actions and AJAX routes skip the check that a backend user can access the page a mail or recipient group belongs to. A backend user with mail module access can view, change, send and export mails and recipient groups outside their web mounts, including recipients' personal data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","self-hosted","typo3"],"not_affected_if":["no-mail-module","single-trusted-backend-user"],"how_to_check":"- Not yet confirmed which TYPO3 package is affected; the description names only 'the mail module'. If you use a backend mail/newsletter extension (e.g. mediaessenz/mail), check the TYPO3 security advisories at news.typo3.com/security/advisory for this CVE id and compare your installed version.\n- Review which backend users have mail module access and whether their web mounts are restricted.","fix":null,"status":"open","published_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","triaged_at":"2026-11-03T10:20:36+00:00","updated_at":"2026-11-03T10:21:38+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-03T10:20:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TYPO3 mail module lets backend users reach mails outside their page access","impact":"medium","summary":"The mail module's backend actions and AJAX routes skip the check that a backend user can access the page a mail or recipient group belongs to. A backend user with mail module access can view, change, send and export mails and recipient groups outside their web mounts, including recipients' personal data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["typo3","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"backend user reads and sends mails and recipient personal data","analyst_note":"Confirm affected TYPO3 version ranges and fixed releases from the NVD entry or the TYPO3 security advisory.","how_to_check":"- Check the installed TYPO3 core or mail extension version against the affected ranges in the NVD entry.\n- Review which backend users have access to the mail module and whether their web mounts are restricted.\n- unknown for exact affected version ranges, as the sources do not list them.","plain_action":"","needs_analyst":true,"not_affected_if":["no-mail-module","single-trusted-backend-user"],"who_is_affected":"Sites running the TYPO3 mail module where backend users have mail module access but are restricted to certain web mounts. The exposure depends on that restriction, and installations without mail module access for limited editors are less exposed. unknown for the exact affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4106,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected TYPO3 version ranges and fixed releases from the NVD entry or the TYPO3 security advisory.","search":"'-120330':15A,18A '-2026':14A,17A 'access':12A,42B,58B,94C,108C 'action':30B,78C 'ajax':32B,80C 'backend':5A,29B,39B,53B,77C,91C,105C 'belong':50B 'chang':61B,115C 'check':36B,88C 'cms':19B 'cve':13A,16A 'data':76B,130C 'export':64B,118C 'group':49B,68B,104C,122C 'host':23B 'includ':73B,127C 'let':4A 'mail':2A,8A,26B,46B,56B,65B,84C,101C,111C,119C 'modul':3A,27B,57B,85C,112C 'mount':72B,126C 'outsid':9A,69B,123C 'packag':20B 'page':11A,44B,97C 'person':75B,129C 'reach':7A 'recipi':48B,67B,74B,103C,121C,132C 'request':100C 'rout':33B,81C 'self':22B 'self-host':21B 'send':62B,116C 'skip':34B 'typo3':1A,24B 'user':6A,40B,54B,92C,106C 'view':60B,114C 'web':71B,125C 'whether':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TYPO3 mail module where backend users have mail module access but are restricted to certain web mounts. The exposure depends on that restriction, and installations without mail module access for limited editors are less exposed. unknown for the exact affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","high","package","selfhosted","typo3"],"first_public_at":"2026-11-03T10:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120330","severity":null,"published_at":"2026-11-03T10:17:17+00:00","modified_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","fetched_at":"2026-11-03T10:20:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120330:1480","url":null,"severity":null,"published_at":"2026-11-03T10:21:38+00:00","modified_at":"2026-11-03T10:21:38+00:00","first_seen_at":"2026-11-03T10:21:38+00:00","fetched_at":"2026-11-03T10:21:38+00:00","note":"No TYPO3 advisory (core or EXT-SA) found yet for this CVE; NVD page returned no readable text. Affected product/versions and fix unknown. Likely a third-party mail extension (candidates: mediaessenz/mail, not confirmed; its 4.1.0 changelog covers a different recipient-permission change). Settle by reading news.typo3.com/security/advisory once published or the NVD CPE/references. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}