Bug 2565672 (CVE-2026-120330)

Summary: CVE-2026-120330 mail: TYPO3 Mail: Information disclosure via missing access control checks
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jpasqual, juwatts, lblicha, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, rchan, smallamp, tmalecek, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the TYPO3 Mail extension. This vulnerability allows an authenticated backend user to access and disclose sensitive email and recipient information beyond their authorized permissions. The issue occurs because administrative actions and background web request endpoints fail to verify whether a user has permission to access the requested page or recipient group. Consequently, an attacker can view, modify, send, or export unauthorized emails and recipient records, exposing recipients' personal data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 10:01:38 UTC 
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.