CVE-2026-120328
Received Received - Intake

Clickjacking in Newsletter Click Tracking Middleware

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: TYPO3

Description
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120328
EUVD
EUVD-2026-115741

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "Mail" 4.0.0
TYPO3 Extension "Mail" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the click tracking middleware of a TYPO3 extension called 'Mail'. The system fails to check the authentication code of a newsletter recipient when the code is missing, allowing unauthenticated attackers to access personal data of those recipients.

Detection Guidance

To detect this vulnerability, check if your TYPO3 Mail extension is running an affected version (3.12.4 or below, or 4.0.0 to 4.1.0). Review server logs for unusual access to newsletter recipient data or unexpected redirects. Inspect network traffic for unauthorized requests to internal hosts.

Impact Analysis

Unauthenticated attackers can retrieve personal data of newsletter recipients, potentially exposing sensitive information like email addresses and other details included in sent mails. This could lead to privacy breaches or misuse of personal data.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by allowing unauthorized access to personal data. Organizations using this system may face legal penalties, fines, or reputational damage due to non-compliance with data privacy requirements.

Mitigation Strategies

Update the TYPO3 Mail extension to the latest patched version to ensure proper validation of authentication codes for newsletter recipients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...