CVE-2026-120468 · Package
NO FIX YET
AcyMailing, an email newsletter extension for Joomla, versions 1.0.0 through 11.1.1, lets anyone without an account retrieve every mailing list on the site. The leaked data includes private lists, their descriptions, access levels, owning accounts and subscriber counts.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Joomla sites running AcyMailing in the affected version range are exposed, because the list data is served without login. The WordPress version of the plugin is not affected, and sites without AcyMailing can skip this.
Not affected if acymailing-not-installed, wordpress-plugin
Who cares acymailing, joomla, self-hosted
1.0.0 through 11.1.1No fix yet, per the sources.
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.