{"id":"CVE-2026-120468","kind":"vulnerability","aliases":["CVE-2026-120468"],"related":[],"title":"Joomla AcyMailing extension leaks mailing list metadata to unauthenticated visitors","description":"Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.","summary":"AcyMailing, an email newsletter extension for Joomla, versions 1.0.0 through 11.1.1, lets anyone without an account retrieve every mailing list on the site. The leaked data includes private lists, their descriptions, access levels, owning accounts and subscriber counts.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acymailing","joomla","package","self-hosted"],"not_affected_if":["acymailing-not-installed","wordpress-plugin"],"how_to_check":"- Check the installed AcyMailing version in the Joomla administrator under Extensions > Manage, and compare it with `1.0.0` through `11.1.1`\n- Confirm the site runs Joomla with AcyMailing installed; the WordPress plugin is not affected","fix":null,"status":"open","published_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:53+00:00","updated_at":"2026-11-12T18:42:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T18:42:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Joomla AcyMailing extension leaks mailing list metadata to unauthenticated visitors","impact":"low","summary":"AcyMailing, an email newsletter extension for Joomla, versions 1.0.0 through 11.1.1, lets anyone without an account retrieve every mailing list on the site. The leaked data includes private lists, their descriptions, access levels, owning accounts and subscriber counts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","acymailing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads private mailing list metadata and subscriber counts","analyst_note":"Find the fixed AcyMailing version and the vendor advisory; the NVD entry does not state a fix.","how_to_check":"- Check the installed AcyMailing version in the Joomla administrator under Extensions > Manage, and compare it with `1.0.0` through `11.1.1`\n- Confirm the site runs Joomla with AcyMailing installed; the WordPress plugin is not affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["wordpress-plugin","acymailing-not-installed"],"who_is_affected":"Joomla sites running AcyMailing in the affected version range are exposed, because the list data is served without login. The WordPress version of the plugin is not affected, and sites without AcyMailing can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4612,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120468':13A,16A '-2026':12A,15A '1.0.0':31B,72C '11.1.1':33B,73C 'access':54B,97C,103C 'account':38B,57B,107C 'acymail':2A,17B,23B,71C 'acymailing.com':63C 'affect':116C 'anyon':35B 'attack':76C 'count':60B,110C 'cve':11A,14A 'data':48B 'descript':53B,102C 'disclosur':65C 'email':25B 'everi':40B,79C 'extens':3A,27B,62C 'host':22B 'includ':49B,85C 'joomla':1A,18B,29B,61C 'leak':4A,47B 'let':34B 'level':55B,98C,104C 'list':6A,42B,51B,68C,81C,86C,93C 'mail':5A,41B,67C,80C 'metadata':7A,69C 'newslett':26B 'own':56B,105C 'packag':19B 'plugin':113C 'privat':50B 'public':90C 'restrict':94C 'retriev':39B,78C 'self':21B 'self-host':20B 'site':45B,84C 'subscrib':59B,109C 'togeth':99C 'unauthent':9A,64C,75C 'user':106C 'version':30B 'visibl':91C 'visitor':10A 'without':36B 'wordpress':112C","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running AcyMailing in the affected version range are exposed, because the list data is served without login. The WordPress version of the plugin is not affected, and sites without AcyMailing can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acymailing","joomla","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-120468':13A,16A '-2026':12A,15A 'acymail':2A 'cve':11A,14A 'extens':3A 'joomla':1A 'leak':4A 'list':6A 'mail':5A 'metadata':7A 'unauthent':9A 'visitor':10A","search_b":"'1.0.0':31B '11.1.1':33B 'access':54B 'account':38B,57B 'acymail':17B,23B 'anyon':35B 'count':60B 'data':48B 'descript':53B 'email':25B 'everi':40B 'extens':27B 'host':22B 'includ':49B 'joomla':18B,29B 'leak':47B 'let':34B 'level':55B 'list':42B,51B 'mail':41B 'newslett':26B 'own':56B 'packag':19B 'privat':50B 'retriev':39B 'self':21B 'self-host':20B 'site':45B 'subscrib':59B 'version':30B 'without':36B","search_c":"'1.0.0':72C '11.1.1':73C 'access':97C,103C 'account':107C 'acymail':71C 'acymailing.com':63C 'affect':116C 'attack':76C 'count':110C 'descript':102C 'disclosur':65C 'everi':79C 'extens':62C 'includ':85C 'joomla':61C 'level':98C,104C 'list':68C,81C,86C,93C 'mail':67C,80C 'metadata':69C 'own':105C 'plugin':113C 'public':90C 'restrict':94C 'retriev':78C 'site':84C 'subscrib':109C 'togeth':99C 'unauthent':64C,75C 'user':106C 'visibl':91C 'wordpress':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120468","severity":null,"published_at":"2026-11-12T18:17:18+00:00","modified_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}