Click Tracking Middleware Vulnerability in TYPO3 by TYPO3 Association
CVE-2026-120327

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "mail"
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120327?

A flaw in the click tracking middleware of TYPO3 allows attackers to submit arbitrary URLs for redirection. This vulnerability can be exploited to divert users to potentially harmful external sites, posing significant security risks to website visitors and compromising their data privacy.

Affected Version(s)

Extension "Mail" 4.0.0 < 4.2.0

Extension "Mail" 0 < 3.12.5

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-037
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander Grein
Alexander Grein
.