---
id: "CVE-2026-120330"
kind: "vulnerability"
aliases: ["CVE-2026-120330"]
title: "TYPO3 mail module lets backend users reach mails outside their page access"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "self-hosted", "typo3"]
not_affected_if: ["no-mail-module", "single-trusted-backend-user"]
published_at: "2026-11-03T10:17:17+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:21:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120330", "first_seen_at": "2026-11-03T10:20:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T10:21:38+00:00"}]
---

# TYPO3 mail module lets backend users reach mails outside their page access

The mail module's backend actions and AJAX routes skip the check that a backend user can access the page a mail or recipient group belongs to. A backend user with mail module access can view, change, send and export mails and recipient groups outside their web mounts, including recipients' personal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Not yet confirmed which TYPO3 package is affected; the description names only 'the mail module'. If you use a backend mail/newsletter extension (e.g. mediaessenz/mail), check the TYPO3 security advisories at news.typo3.com/security/advisory for this CVE id and compare your installed version.
- Review which backend users have mail module access and whether their web mounts are restricted.

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120330
- 2026-11-03T10:21:38+00:00 analyst — No TYPO3 advisory (core or EXT-SA) found yet for this CVE; NVD page returned no readable text. Affected product/versions and fix unknown. Likely a third-party mail extension (candidates: mediaessenz/mail, not confirmed; its 4.1.0 changelog covers a different recipient-permission change). Settle by reading news.typo3.com/security/advisory once published or the NVD CPE/references. Nothing verified.

## From the sources

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_