Improper Access Control in AcyMailing by Acyba
CVE-2026-120471

6.9MEDIUM

Key Information:

Vendor

WordPress
Status
Acymailing Extension For Joomla
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120471?

The AcyMailing extension for Joomla has a vulnerability that allows unauthenticated users to access site modules outside of their designated access levels. This flaw permits sensitive content to be visible to visitors who should not have the necessary permissions, thus exposing information that is usually restricted to higher access levels. This issue could potentially lead to serious privacy and security risks for Joomla websites utilizing the AcyMailing extension.

Affected Version(s)

AcyMailing extension for Joomla 1.0.0-11.1.1

References

https://www.acymailing.com/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor / mySites.guru
.