CVE-2026-120468: Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.
Event History
Frequently Asked Questions
Which deployments are affected?
The affected product is the Joomla extension AcyMailing versions 1.0.0 through 11.1.1. The WordPress plugin is not affected.
Does exploitation require an account or access to restricted lists?
No. An unauthenticated attacker can retrieve metadata for every mailing list, including lists that are not publicly visible or are restricted by access level.
What information can be exposed?
Exposed metadata includes mailing-list descriptions, access levels, the owning user account, and subscriber counts.