Access Control Vulnerability in TYPO3 Mail Module

CVE-2026-120330

What is CVE-2026-120330?

The TYPO3 Mail Module contains a vulnerability where backend actions and AJAX routes fail to verify that backend users have the appropriate permissions to access specified mails or recipient groups. This flaw allows backend users who have access to the mail module to potentially view, modify, send, and export emails and recipient groups beyond their established access rights. Consequently, unauthorized access to personal data of recipients is possible, posing a significant risk to user privacy and data security. It is imperative for users and administrators to apply the relevant security patch to mitigate this risk.

References