{"id":"CVE-2026-120467","kind":"vulnerability","aliases":["CVE-2026-120467"],"related":[],"title":"AcyMailing: any logged-in user can change other subscribers' mailing lists","description":"Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.","summary":"AcyMailing, a newsletter extension for Joomla and WordPress, does not check that the subscriber being changed is the one the request refers to. Any authenticated user can subscribe or unsubscribe any other subscriber to or from any mailing list on the site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"acymailing","fixed":["11.1.2"],"affected":">= 1.0.0, <= 11.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acymailing","authenticated","email-marketing","joomla","other","wordpress"],"not_affected_if":["fixed-version","no-acymailing"],"how_to_check":"Check the installed AcyMailing version (Joomla: Extensions > Manage, component com_acym; WordPress: Plugins). Versions 1.0.0 through 11.1.1 are affected; 11.1.2 is fixed. On Joomla, a site that lost its AcyMailing update site is not offered 11.1.2 and Joomla may still report it as up to date, so check the version by hand and install the 11.1.2 package over the top.","fix":"Update AcyMailing to 11.1.2 or later (Joomla and WordPress). The vendor's changelog says a request now acts only on the subscriber it identified and is protected by a security token.","status":"open","published_at":"2026-11-12T19:16:48+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","triaged_at":"2026-11-12T19:40:48+00:00","updated_at":"2026-11-12T19:41:46+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T19:40:48Z","model":"claude-haiku-5-5","output":{"fix":"- Versions from `11.1.2` onward are not affected per the advisory range; confirm the exact fixed version with the vendor.\n- unknown","reach":"internet","title":"AcyMailing: any logged-in user can change other subscribers' mailing lists","impact":"low","summary":"AcyMailing, a newsletter extension for Joomla and WordPress, does not check that the subscriber being changed is the one the request refers to. Any authenticated user can subscribe or unsubscribe any other subscriber to or from any mailing list on the site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","wordpress","acymailing","email-marketing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Any logged-in user changes other subscribers' mailing list memberships","analyst_note":"Confirm the fixed version and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-120467; the sources give no fix version.","how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager; affected versions are `1.0.0` through `11.1.1`.\n- unknown","plain_action":"","product_name":"acymailing","needs_analyst":true,"not_affected_if":["no-acymailing","fixed-version"],"who_is_affected":"Sites running the AcyMailing extension in the affected version range on Joomla or WordPress. Exposure requires that users with at least a basic account can log in to the site. Sites without AcyMailing, or on versions outside the range, can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4562,"output_tokens":604,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-120467; the sources give no fix version.","search":"'-120467':15A,18A '-2026':14A,17A '1.0.0':85C '11.1.1':86C 'act':81C 'acymail':1A,20B,28B,84C 'acymailing':19A 'acymailing.com':73C 'authent':21B,52B,88C 'bound':77C 'chang':8A,43B 'check':38B 'cve':13A,16A 'email':23B 'email-market':22B 'extens':31B,72C 'ident':75C 'joomla':25B,33B,70C 'level':93C 'list':12A,66B,106C 'log':4A 'logged-in':3A 'mail':11A,65B,105C 'market':24B 'newslett':30B 'one':46B 'privileg':92C 'record':80C 'refer':49B 'request':48B 'site':69B,109C 'subscrib':10A,41B,55B,60B,74C,95C,100C 'unsubscrib':57B,97C 'upon':82C 'user':6A,53B,89C 'wordpress':27B,35B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AcyMailing extension in the affected version range on Joomla or WordPress. Exposure requires that users with at least a basic account can log in to the site. Sites without AcyMailing, or on versions outside the range, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T19:41:46Z","by":"analyst","doc":"https://www.acymailing.com/changelog/","run_id":3768}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["acymailing"],"ptokens":["acymailing"],"labels":["acymailing","authenticated","emailmarketing","high","joomla","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-120467':15A,18A '-2026':14A,17A 'acymail':1A 'acymailing':19A 'chang':8A 'cve':13A,16A 'list':12A 'log':4A 'logged-in':3A 'mail':11A 'subscrib':10A 'user':6A","search_b":"'acymail':20B,28B 'authent':21B,52B 'chang':43B 'check':38B 'email':23B 'email-market':22B 'extens':31B 'joomla':25B,33B 'list':66B 'mail':65B 'market':24B 'newslett':30B 'one':46B 'refer':49B 'request':48B 'site':69B 'subscrib':41B,55B,60B 'unsubscrib':57B 'user':53B 'wordpress':27B,35B","search_c":"'1.0.0':85C '11.1.1':86C 'act':81C 'acymail':84C 'acymailing.com':73C 'authent':88C 'bound':77C 'extens':72C 'ident':75C 'joomla':70C 'level':93C 'list':106C 'mail':105C 'privileg':92C 'record':80C 'site':109C 'subscrib':74C,95C,100C 'unsubscrib':97C 'upon':82C 'user':89C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120467","severity":null,"published_at":"2026-11-12T19:16:48+00:00","modified_at":"2026-11-12T19:16:48+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","fetched_at":"2026-11-12T19:40:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120467:3768","url":"https://www.acymailing.com/changelog/","severity":null,"published_at":"2026-11-12T19:41:46+00:00","modified_at":"2026-11-12T19:41:46+00:00","first_seen_at":"2026-11-12T19:41:46+00:00","fetched_at":"2026-11-12T19:41:46+00:00","note":"Vendor changelog (acymailing.com/changelog) lists 11.1.2 (2026-11-12) fixing 'any logged-in user could subscribe or unsubscribe any other subscriber'. The vendor's per-CVE advisory page is not published yet (changelog says full details will follow). The 1.0.0 lower bound comes from NVD, not the vendor. mySites.guru says all versions up to 11.1.1 are affected. No exploitation or PoC found.","cites":["https://www.acymailing.com/changelog/","https://mysites.guru/blog/acymailing-update-site-disappears/"]}],"documents":[{"id":137494,"url":"https://www.acymailing.com/changelog/","title":"AcyMailing changelog (11.1.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":137959,"url":"https://mysites.guru/blog/acymailing-update-site-disappears/","title":"mySites.guru: AcyMailing 11.1.2 fixes seven front-end flaws","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}