CVE-2026-120471 · Package
NO FIX YET
AcyMailing, a Joomla extension, can render a site module regardless of the access level that module is restricted to. An unauthenticated visitor can therefore see content meant only for higher access levels.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AcyMailing Joomla extension between versions 1.0.0 and 11.1.1. The WordPress plugin is not affected. Sites that do not use AcyMailing or do not restrict modules by access level are unlikely to expose anything.
Not affected if no-restricted-modules, not-joomla, wordpress-plugin
Who cares acymailing, joomla, self-hosted
No fix yet, per the sources.
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.