Unauthorized Account Actions in TYPO3 Extension Compromise User Data

CVE-2026-120333

What is CVE-2026-120333?

This vulnerability in the TYPO3 extension involves inadequate validation of request hashes in email actions, allowing unauthenticated attackers to perform malicious operations on behalf of legitimate users. Attackers can exploit this weakness to manipulate user accounts, potentially revealing sensitive information like email addresses or usernames, as well as enabling account deletions without authorization.

References