CVE-2026-120332 is a vulnerability where the HTML content of emails and tracked URLs is rendered without escaping in a backend module. This allows backend users with access to the mail module to inject arbitrary HTML and JavaScript. The injected code executes in the context of other backend users who view the mail preview or report, potentially leading to cross-site scripting (XSS).