Threats affecting pkg:composer/mediaessenz/mail

CVE-2026-120327 is an open redirect vulnerability in the TYPO3 Extension "Mail". The click tracking middleware improperly accepts arbitrary target URLs and redirects users to them. This flaw allows attackers to craft malicious links that redirect users from the TYPO3 site to external, potentially harmful websites. The vulnerability affects versions 4.0.0 up to but not including 4.2.0 and versions prior to 3.12.5. A fix is available in versions 4.2.0 and 3.12.5.

CVE-2026-120328 is an authorization bypass vulnerability in the TYPO3 Extension "Mail". The click tracking middleware fails to validate the authentication code of newsletter recipients if the code is omitted. This allows unauthenticated attackers to access personal data of newsletter recipients embedded in email links. The issue affects versions 3.12.5 up to but not including 4.2.0 and versions prior to 3.12.5. A fix is available in versions 4.2.0 and 3.12.5.

CVE-2026-120329 is a medium severity vulnerability in the TYPO3 Extension "Mail" that allows backend users with access to the mail module to write arbitrary page TSconfig. This occurs because the configuration saving process does not restrict submitted settings to valid module options, leading to injection of arbitrary configuration.

CVE-2026-120330 is a missing authorization vulnerability in the TYPO3 Extension "Mail". Backend users with access to the mail module can perform actions on mails and recipient groups outside their authorized web mounts, including viewing, changing, sending, and exporting mails and recipient data. This exposes personal data of recipients to unauthorized backend users.

CVE-2026-120331 is a server-side request forgery (SSRF) vulnerability in the TYPO3 Extension "Mail". The extension fetches content from external URLs, including stylesheets and images, without validating the target host. This allows backend users with access to the mail module to make the server send requests to internal network hosts. The vulnerability affects versions >=4.0.0 <4.2.0 and >=0 <3.12.5 and has been fixed in versions 4.2.0 and 3.12.5. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-120332 is a cross-site scripting (XSS) vulnerability in the TYPO3 Extension "Mail". The issue arises because HTML content of mails and tracked URLs are rendered without escaping in the backend module. Backend users with access to this mail module can inject arbitrary HTML and JavaScript, which executes in the context of other backend users viewing mail previews or reports. This vulnerability affects certain versions prior to 4.2.0 and 3.12.5, and has a medium severity rating.