TYPO3 Mail: backend users reach mails outside web mounts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-862.
Summary
Backend actions and ajax routes of the TYPO3 extension "Mail" do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients. The weakness is CWE-862 (Missing Authorization). CISA has not added the issue to KEV, and its SSVC exploitation status is none.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update the Mail extension to 4.2.0 or later in the 4.x line, or to 3.12.5 or later in the 3.x line. Versions before 4.0.0 with a from value of 0 are fixed in 3.12.5. Red Hat Satellite 6 is affected with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Extension "Mail" (TYPO3) Fixed in 4.2.0, 3.12.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
TYPO3 Extension "Mail" — typo3.org/security/advisory/typo3-ext-sa-2026-037
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-84198 Information disclosure in TYPO3 extension Mail exposes recipient dataPriority LOW 37
- TI-2026-84197 Open redirection in TYPO3 extension MailPriority LOW 30
- TI-2026-84201 Server-Side Request Forgery in TYPO3 extension MailPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix yet |
Timeline
- 2026-11-03 Threatist record created from CVE-2026-120330
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
- 2026-11-03 Alias added: GHSA-2xxv-cj6j-pj6f
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
References
More TYPO3 vulnerabilities
- TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
- TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
- TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
- TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
- TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
- TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-120330 · CVE Program
- CVE-2026-120330 · NVD
- FIRST EPSS
- GHSA-2xxv-cj6j-pj6f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-120330 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences