Live › vulnerability › CVE-2026-120331
The server fetches the contents, stylesheets and images of external URL mails without validating the target host. A backend user with access to the mail module can make the server send requests to hosts on the internal network (server-side request forgery).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Affects products whose mail module fetches external URLs for mail content, and only for backend users who already have access to that module. Systems where the mail module is not used, or where backend access is restricted to trusted staff, carry lower risk. The sources do not name the affected product or versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
This page as .md · .json · in your agent: get_signal("CVE-2026-120331")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.