Authentication Bypass Vulnerability in TYPO3 Click Tracking Middleware
CVE-2026-120328

6.9MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "mail"
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120328?

A vulnerability exists in TYPO3's click tracking middleware, where the authentication code of a recipient is not validated if omitted. This flaw allows unauthenticated attackers to gain unauthorized access to personal data of newsletter recipients embedded in the links of sent emails, potentially leading to privacy violations and data leaks.

Affected Version(s)

Extension "Mail" 4.0.0 < 4.2.0

Extension "Mail" 0 < 3.12.5

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-037
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander Grein
Alexander Grein
.