Live › vulnerability › CVE-2026-120333
The actions linked in the extension's emails, such as confirming a registration or deleting an account, accept requests without a valid hash and use the frontend user named in the request. An unauthenticated attacker can therefore delete arbitrary active frontend user accounts and retrieve their email addresses or usernames.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
The sources do not name the extension or its versions, so the exact exposure is unknown. Sites running the affected extension with frontend user registration and account actions triggered from emails are the likely target. unknown
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-120333")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.