---
id: "CVE-2026-120467"
page: "https://infrastack.ai/live/CVE-2026-120467"
kind: "vulnerability"
aliases: ["CVE-2026-120467"]
title: "AcyMailing: any logged-in user can change other subscribers' mailing lists"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "acymailing", "fixed": ["11.1.2"], "affected": ">= 1.0.0, <= 11.1.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acymailing", "authenticated", "email-marketing", "joomla", "other", "wordpress"]
not_affected_if: ["fixed-version", "no-acymailing"]
published_at: "2026-11-12T19:16:48+00:00"
first_seen_at: "2026-11-12T19:40:13+00:00"
updated_at: "2026-11-12T19:41:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120467", "first_seen_at": "2026-11-12T19:40:13+00:00"}, {"source": "analyst", "url": "https://mysites.guru/blog/acymailing-update-site-disappears/", "first_seen_at": "2026-11-12T19:41:46+00:00", "cites": ["https://mysites.guru/blog/acymailing-update-site-disappears/", "https://www.acymailing.com/changelog/"]}]
exploit_sources: []
---

# AcyMailing: any logged-in user can change other subscribers' mailing lists

Link for people: https://infrastack.ai/live/CVE-2026-120467 (this .md is for agents)

AcyMailing, a newsletter extension for Joomla and WordPress, does not check that the subscriber being changed is the one the request refers to. Any authenticated user can subscribe or unsubscribe any other subscriber to or from any mailing list on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:acymailing affected >= 1.0.0, <= 11.1.1 fixed 11.1.2

## How to check

Check the installed AcyMailing version (Joomla: Extensions > Manage, component com_acym; WordPress: Plugins). Versions 1.0.0 through 11.1.1 are affected; 11.1.2 is fixed. On Joomla, a site that lost its AcyMailing update site is not offered 11.1.2 and Joomla may still report it as up to date, so check the version by hand and install the 11.1.2 package over the top.

## Fix

Update AcyMailing to 11.1.2 or later (Joomla and WordPress). The vendor's changelog says a request now acts only on the subscriber it identified and is protected by a security token.

## Timeline

- 2026-11-12T19:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120467
- 2026-11-12T19:41:46+00:00 analyst https://mysites.guru/blog/acymailing-update-site-disappears/ — Vendor changelog (acymailing.com/changelog) lists 11.1.2 (2026-11-12) fixing 'any logged-in user could subscribe or unsubscribe any other subscriber'. The vendor's per-CVE advisory page is not published yet (changelog says full details will follow). The 1.0.0 lower bound comes from NVD, not the vendor. mySites.guru says all versions up to 11.1.1 are affected. No exploitation or PoC found.

## Documents

- [describes] mySites.guru: AcyMailing 11.1.2 fixes seven front-end flaws https://mysites.guru/blog/acymailing-update-site-disappears/
- [fix] AcyMailing changelog (11.1.2) https://www.acymailing.com/changelog/

## From the sources

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_