{"id":"CVE-2026-120470","kind":"vulnerability","aliases":["CVE-2026-120470"],"related":[],"title":"AcyMailing: unpublished email campaigns readable without any login","description":"Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.","summary":"AcyMailing, an email newsletter extension for Joomla and WordPress, lets anyone without an account read the online version of campaigns that were never made public. This includes campaigns unpublished after sending and campaigns sent only to a restricted audience.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acymailing","email-marketing","joomla","other","wordpress"],"not_affected_if":["not-running-acymailing","version-above-11.1.1"],"how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager; versions `1.0.0` through `11.1.1` are listed as affected.\n- Try opening an old or unpublished campaign's online (web) version link while logged out.","fix":"- Move to a version newer than `11.1.1`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:53+00:00","updated_at":"2026-11-12T18:42:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T18:42:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `11.1.1`; the sources do not name the exact fixed release.","reach":"internet","title":"AcyMailing: unpublished email campaigns readable without any login","impact":"medium","summary":"AcyMailing, an email newsletter extension for Joomla and WordPress, lets anyone without an account read the online version of campaigns that were never made public. This includes campaigns unpublished after sending and campaigns sent only to a restricted audience.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","wordpress","acymailing","email-marketing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Anyone reads private or unpublished email campaign content without logging in","analyst_note":"Confirm the fixed version and the vendor advisory for AcyMailing; the NVD entry gives only the affected range.","how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager; versions `1.0.0` through `11.1.1` are listed as affected.\n- Try opening an old or unpublished campaign's online (web) version link while logged out.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-running-acymailing","version-above-11.1.1"],"who_is_affected":"Sites running the AcyMailing extension for Joomla or WordPress in versions `1.0.0` through `11.1.1`. Exposure is about campaign content that was sent to a restricted audience or unpublished after sending; sites that only send public campaigns have less to lose. The sources do not say whether a default configuration is exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4563,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120470':11A,14A '-2026':10A,13A '1.0.0':77C '11.1.1':78C 'account':35B 'acymail':1A,15B,22B,76C 'acymailing.com':64C 'anyon':32B 'attack':81C 'audienc':60B,106C 'campaign':4A,41B,49B,54B,88C,95C,101C 'check':74C 'cve':9A,12A 'email':3A,17B,24B,69C 'email-market':16B 'extens':26B,63C 'includ':48B,94C 'joomla':19B,28B,61C 'let':31B 'login':8A 'made':45B,92C 'market':18B 'never':44B,91C 'newslett':25B 'onlin':38B,65C,85C 'public':46B,93C 'read':36B,83C 'readabl':5A,70C 'restrict':59B,105C 'send':52B 'sent':55B,99C,102C 'unauthent':80C 'unpublish':2A,50B,96C 'version':39B,66C,86C 'visibl':73C 'without':6A,33B,71C 'wordpress':21B,30B,62C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AcyMailing extension for Joomla or WordPress in versions `1.0.0` through `11.1.1`. Exposure is about campaign content that was sent to a restricted audience or unpublished after sending; sites that only send public campaigns have less to lose. The sources do not say whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acymailing","emailmarketing","joomla","medium","other","wordpress"],"campaign_type":null,"search_a":"'-120470':11A,14A '-2026':10A,13A 'acymail':1A 'campaign':4A 'cve':9A,12A 'email':3A 'login':8A 'readabl':5A 'unpublish':2A 'without':6A","search_b":"'account':35B 'acymail':15B,22B 'anyon':32B 'audienc':60B 'campaign':41B,49B,54B 'email':17B,24B 'email-market':16B 'extens':26B 'includ':48B 'joomla':19B,28B 'let':31B 'made':45B 'market':18B 'never':44B 'newslett':25B 'onlin':38B 'public':46B 'read':36B 'restrict':59B 'send':52B 'sent':55B 'unpublish':50B 'version':39B 'without':33B 'wordpress':21B,30B","search_c":"'1.0.0':77C '11.1.1':78C 'acymail':76C 'acymailing.com':64C 'attack':81C 'audienc':106C 'campaign':88C,95C,101C 'check':74C 'email':69C 'extens':63C 'includ':94C 'joomla':61C 'made':92C 'never':91C 'onlin':65C,85C 'public':93C 'read':83C 'readabl':70C 'restrict':105C 'sent':99C,102C 'unauthent':80C 'unpublish':96C 'version':66C,86C 'visibl':73C 'without':71C 'wordpress':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120470","severity":null,"published_at":"2026-11-12T18:17:18+00:00","modified_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}