TYPO3 Mail extension has several flaws (redirects, data exposure, access bypass)

Summary

The Mail extension for TYPO3 has open redirect, information disclosure, broken access control, server-side request forgery and cross-site scripting flaws. Attackers can send users to outside sites or read recipients' personal data, and backend users with mail module access can reach other users' mails and internal hosts.

Affected when

• Mail extension installed on TYPO3 CMS
• Mail 3.12.4 and below or 4.0.0 - 4.1.0

What to do

Update the Mail extension to 3.12.5 or 4.2.0 through the TYPO3 extension manager, packagist or the official download page.

Update to at least the version for your product:

• TYPO3 Mail 3.x 3.12.5 or later
• TYPO3 Mail 4.x 4.2.0 or later

Products and platforms

• TYPO3 extension "Mail" (mail)

CVE IDs

• CVE-2026-120332 (opens in a new tab)
• CVE-2026-120330 (opens in a new tab)
• CVE-2026-120331 (opens in a new tab)
• CVE-2026-120329 (opens in a new tab)
• CVE-2026-120327 (opens in a new tab)
• CVE-2026-120328 (opens in a new tab)

Sources

• Advisory: typo3.org (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-03 09:56 UTC

First seen 2026-11-09 14:10 UTC