CVE-2026-118175

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1181768.1Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt CVE-2026-1181779.1When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted cale CVE-2026-1181785.7A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-1181798.8Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the lin CVE-2026-118185.4The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all CVE-2026-1181807.5When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. CVE-2026-1181845.3The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in CVE-2026-1181857.5The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for CVE-2026-1181864.9The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly r CVE-2026-1181872.7The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that CVE-2026-1181884.3The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that CVE-2026-1181896.4The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all