CVE-2026-120328

MediumCVSS 6.9/10Last modified Nov 3, 2026

Description

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1203295.3Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configura CVE-2026-120335.3Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to CVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or rec CVE-2026-1203315.3Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend us CVE-2026-1203325.1The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can in CVE-2026-1203338.8The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with CVE-2026-1203344.3A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling CVE-2026-1203354.8A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/lang CVE-2026-1203367.3A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevD CVE-2026-1203377.3A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperI CVE-2026-12033810.0Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feat CVE-2026-1203394.3A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatede