This vulnerability (CVE-2026-120331) involves a mail module that fetches content from external URLs, including stylesheets and images, without validating the target host. Backend users with access to this mail module can cause the server to send requests to internal network hosts. This behavior can potentially be abused to access internal resources. The vulnerability has a medium severity rating with a CVSS score of 5.3.