CVE-2026-120329: TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)

Q: Who can exploit this issue?

A backend user who has access to the Mail backend module can exploit it. The issue requires authenticated backend access with that module permission; no user interaction is required.

Q: What capability does successful exploitation provide?

The affected configuration-saving function can write arbitrary page TSconfig submitted by the backend user, rather than limiting writes to Mail module configuration options.

Q: Are installations unaffected if the Mail module is installed but not accessible to ordinary backend users?

The described attack path depends on access to the Mail backend module. Restricting that module to trusted backend users reduces exposure, based on the available information.

Q: What can be done while waiting to patch?

Remove or restrict Mail backend module access for backend users who should not be able to alter page TSconfig. Review page TSconfig changes made through the module by users who had this access.

Published Nov 3, 2026

Updated

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

Other sources

TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)

— Packagist

Affected Software

2 affected componentsFixes available

composer/mediaessenz/mail>=4.0.0, <4.2.0

4.2.0

composer/mediaessenz/mail<3.12.5

3.12.5

Event History

Nov 3, 2026

Advisory Published

via Packagist·09:00 AM

Data Sourced

via Packagist·09:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·09:56 AM

Data Sourced

via MITRE·09:56 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A backend user who has access to the Mail backend module can exploit it. The issue requires authenticated backend access with that module permission; no user interaction is required.

What capability does successful exploitation provide?

The affected configuration-saving function can write arbitrary page TSconfig submitted by the backend user, rather than limiting writes to Mail module configuration options.

Are installations unaffected if the Mail module is installed but not accessible to ordinary backend users?

The described attack path depends on access to the Mail backend module. Restricting that module to trusted backend users reduces exposure, based on the available information.

What can be done while waiting to patch?

Remove or restrict Mail backend module access for backend users who should not be able to alter page TSconfig. Review page TSconfig changes made through the module by users who had this access.

CVE-2026-120329: TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)

Other sources

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does successful exploitation provide?

Are installations unaffected if the Mail module is installed but not accessible to ordinary backend users?

What can be done while waiting to patch?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does successful exploitation provide?

Are installations unaffected if the Mail module is installed but not accessible to ordinary backend users?

What can be done while waiting to patch?