CVE-2026-39791: CWE-201 Insertion of Sensitive Information Into Sent Data in Mailjet Mailjet Email Marketing

This vulnerability, identified as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects Mailjet Email Marketing versions up to 6.2.3. It allows an unauthenticated attacker to cause sensitive information to be exposed by insertion into data sent by the service. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to confidentiality loss without integrity or availability impact. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.

The vulnerability leads to partial confidentiality loss due to sensitive data exposure in sent data. There is no impact on data integrity or system availability. Since the attack requires no privileges or user interaction, it could be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Users should monitor vendor communications for updates and apply any forthcoming patches promptly.