TYPO3 Mail Extension CVE-2026-120327

Exploitation requires the TYPO3 'mail' extension's click tracking middleware to be in use, since that endpoint accepts an arbitrary target URL and performs the redirect; the attacker must then induce a victim to click a crafted tracking link (UI:P passive interaction), which is the main limiting factor. No authentication is required (PR:N) and no special non-default configuration is indicated beyond having click tracking enabled. Impact is confined to redirecting the user to an external site (integrity only); there is no direct confidentiality or availability effect, so realistic risk is phishing/social-engineering rather than direct compromise.

This is a CWE-601 open redirect in the click tracking middleware of the TYPO3 'mail' extension, rated CVSS 5.3 (medium) by the vendor. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates remote, low-complexity, unauthenticated reach but requires passive user interaction (the victim must click a tracking link), and impact is limited to subsequent-system integrity (SI:L) with no confidentiality, availability, or vulnerable-system impact - consistent with a redirection-only flaw rather than code execution or data exposure. There is no CISA KEV listing, no EPSS score, and no PoC or exploit reference in the input; the only reference is the TYPO3 vendor advisory (TYPO3-EXT-SA-2026-037). The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with a real-but-moderate issue rather than an urgent one. No signals conflict: all sources point to a low-to-medium severity open redirect whose primary value to an attacker is phishing/social-engineering credibility, not direct system compromise. No key data is contradictory; EPSS and exploitation-status data are simply absent, so widespread exploitation cannot be assessed from the input.

An attacker crafts a link pointing at the affected site's click tracking endpoint with an attacker-controlled target URL, so the link appears to belong to the trusted TYPO3 site but silently redirects the victim to an external malicious page. When a user clicks it (e.g. in a phishing email or social post), they are forwarded to a credential-harvesting or malware site while trusting the original domain. No public exploit was identified at time of analysis; exploitation requires the victim to click the crafted link (UI:P).