CVE-2026-120471: Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1
Published Nov 12, 2026
·Updated
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected.
Event History
Nov 12, 2026
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
AcyMailing versions 1.0.0 through 11.1.1 on Joomla are affected. The WordPress plugin is not affected.
2
Does exploitation require an account or elevated Joomla permissions?
No. An unauthenticated visitor can trigger rendering of a site module without regard to that module's configured Joomla access level.
3
What is exposed if exploitation succeeds?
Content from Joomla site modules that is intended for users with a higher view access level may be disclosed to unauthenticated visitors.