CVE-2026-120468
Received Received - Intake

Unauthenticated Mailing List Metadata Disclosure in AcyMailing

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Joomla! Project

Description
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-120468
EUVD
EUVD-2026-124609

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
acymailing acymailing 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AcyMailing for Joomla allows an unauthenticated attacker to access mailing list metadata without any credentials. The attacker can retrieve all mailing lists, including private or restricted ones, along with their descriptions, access levels, owner details, and subscriber counts.

Detection Guidance

To detect this vulnerability, check if AcyMailing versions 1.0.0 to 11.1.1 are installed on your Joomla site. Inspect network traffic for unauthenticated requests to mailing list endpoints or metadata endpoints. Look for unusual subscriber count queries or access level disclosures in logs.

Impact Analysis

An attacker could exploit this to gather sensitive information about your email campaigns, subscriber counts, and access levels. This could lead to targeted phishing attacks, data leaks, or unauthorized access to restricted mailing lists.

Compliance Impact

This vulnerability may violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if mailing lists contain such data. It undermines data protection measures and could result in regulatory penalties.

Mitigation Strategies

Immediately update AcyMailing to the latest version beyond 11.1.1. If an update is unavailable, disable the AcyMailing component in Joomla until a patch is released. Review and restrict access to mailing list metadata endpoints in your web server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...