CVE-2026-0895 concerns an insecure deserialization vulnerability (CWE-502) in the TYPO3 CMS extension "Mailqueue" (versions 0 to 0.5.0). TYPO3’s FileSpool component was previously vulnerable to insecure deserialization, which was addressed in TYPO3 core via advisory TYPO3-CORE-SA-2026-004. However, the Mailqueue extension overwrites this core fix by reintroducing the vulnerable code that was extracted from the core into the extension itself. This means that even if the TYPO3 core is patched, the presence of the vulnerable Mailqueue extension allows an attacker to exploit insecure deserialization. The vulnerability allows an attacker with low privileges and partial authentication (PR:L, AT:P) to execute malicious deserialization locally (AV:L), without requiring user interaction (UI:N). The vulnerability impacts confidentiality and integrity (VC:N, VI:L), but not availability. The scope is high (SC:H) and the impact is significant (SI:H, SA:H) because the vulnerability affects a component critical to mail queue processing, potentially allowing manipulation of serialized data leading to code execution or data tampering. No public exploits are known yet, but the vulnerability is published and should be addressed promptly.

For European organizations using TYPO3 CMS with the Mailqueue extension, this vulnerability poses a risk of unauthorized code execution or data manipulation via insecure deserialization. This can lead to compromise of sensitive data, unauthorized access to internal systems, and potential disruption of email processing workflows. Organizations in sectors such as government, finance, healthcare, and critical infrastructure that rely on TYPO3 for web content management are particularly at risk. The requirement for low privileges and partial authentication reduces the attack complexity but limits remote exploitation, meaning insider threats or compromised accounts could be leveraged. The vulnerability could also be used as a foothold for lateral movement within networks. The impact on confidentiality and integrity is medium to high, potentially leading to data breaches or defacement of websites. Given TYPO3’s popularity in Europe, especially in Germany, the Netherlands, and Austria, the threat is relevant for many European entities.

1. Immediately audit TYPO3 installations to identify the presence of the Mailqueue extension, especially versions 0 through 0.5.0. 2. Remove or disable the Mailqueue extension if it is not essential. 3. If the extension is required, check for any updated versions or patches from the extension maintainers that address this vulnerability. 4. Apply the TYPO3 core security update TYPO3-CORE-SA-2026-004 and ensure no overrides by extensions reintroduce vulnerable code. 5. Implement strict access controls to limit who can authenticate and access TYPO3 backend or related services. 6. Monitor logs for suspicious deserialization attempts or unusual activity related to mail queue processing. 7. Employ runtime application self-protection (RASP) or web application firewalls (WAF) with rules targeting deserialization attacks. 8. Educate administrators about the risks of insecure deserialization and the importance of extension management. 9. Regularly review and update all TYPO3 extensions to avoid similar issues caused by outdated or unmaintained code.