---
id: "CVE-2026-120468"
page: "https://infrastack.ai/live/CVE-2026-120468"
kind: "vulnerability"
aliases: ["CVE-2026-120468"]
title: "Joomla AcyMailing extension leaks mailing list metadata to unauthenticated visitors"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acymailing", "joomla", "package", "self-hosted"]
not_affected_if: ["acymailing-not-installed", "wordpress-plugin"]
published_at: "2026-11-12T18:17:18+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120468", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# Joomla AcyMailing extension leaks mailing list metadata to unauthenticated visitors

Link for people: https://infrastack.ai/live/CVE-2026-120468 (this .md is for agents)

AcyMailing, an email newsletter extension for Joomla, versions 1.0.0 through 11.1.1, lets anyone without an account retrieve every mailing list on the site. The leaked data includes private lists, their descriptions, access levels, owning accounts and subscriber counts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AcyMailing version in the Joomla administrator under Extensions > Manage, and compare it with `1.0.0` through `11.1.1`
- Confirm the site runs Joomla with AcyMailing installed; the WordPress plugin is not affected

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120468

## From the sources

Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_