CVE-2026-120333 is a vulnerability in an extension where actions linked in emails (such as confirming registration or deleting an account) do not properly validate request hashes. This flaw allows unauthenticated attackers to perform these actions on behalf of arbitrary active frontend users, potentially retrieving user email addresses or usernames and deleting user accounts.