CVE-2026-120328: TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail)
Published Nov 3, 2026
·Updated
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
Other sources
TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail)
— Packagist
Affected Software
2 affected componentsFixes available
composer/mediaessenz/mail>=4.0.0, <4.2.0
4.2.0
composer/mediaessenz/mail<3.12.5
3.12.5
Event History
Nov 3, 2026
Advisory Published
via Packagist·09:00 AM
Data Sourced
via Packagist·09:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·09:56 AM
Data Sourced
via MITRE·09:56 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness