Read the docs
TI-2019-12490 Aliases CVE-2019-16698GHSA-j2w4-45qm-r674

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access…

Priority LOW 21CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862 and CWE-200.

Summary

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

Why it matters now

EPSS 0.00685 52nd percentileScored 2026-11-07
Fix Fixed directmailteam/direct-mail (Packagist): 5.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—directmailteam/direct-mail (Packagist)before 5.2.35.2.3Patch availableGHSA-j2w4-45qm-r674
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • directmailteam/direct-mail (Packagist) Vendor— Affected before 5.2.3 Fixed in 5.2.3 Patch available GHSA-j2w4-45qm-r674

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dkd:direct_mail:*:*:*:*:*:typo3:*:*up to 5.2.2VulnerableDkd
  • cpe:2.3:a:dkd:direct_mail:*:*:*:*:*:typo3:*:* Versions up to 5.2.2 Vulnerable ·Dkd

Remediation

  • Fix · GHSA-j2w4-45qm-r674 directmailteam/direct-mail (Packagist) Fixed in 5.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16698
  2. 2026-10-03 Alias added: GHSA-j2w4-45qm-r674

References

Advisory 3

Other 3

  • TI-2013-06062 The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to… CVSS 3.0HIGH 7.5
  • TI-2020-10098 The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. CVSS 3.1MEDIUM 6.1
  • TI-2020-10096 The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. CVSS 3.1MEDIUM 5.3
  • TI-2020-10099 The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a… CVSS 3.1MEDIUM 4.3
  • TI-2020-10097 The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables. CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences