Unauthenticated Metadata Disclosure in AcyMailing by Acyba

CVE-2026-120468

What is CVE-2026-120468?

The AcyMailing extension for Joomla contains a vulnerability that allows unauthenticated attackers to retrieve sensitive metadata from mailing lists. This includes access restrictions, user accounts associated with the lists, and subscriber counts, even for lists that are not publicly accessible. Such exposure can allow malicious actors to gather information about the site's communications and users, potentially leading to further exploitation. The vulnerability affects versions 1.0.0 through 11.1.1.

References