TYPO3 Mail extension CVE-2026-120329

Requires an authenticated TYPO3 backend user who has been granted access to the mail module; exploitation occurs specifically when saving the mail backend module's configuration, which writes the submitted settings into page TSconfig without restricting them to the module's own configuration options. Limiting factors: a valid backend account and mail-module permission are mandatory (PR:L), so this is not remote-unauthenticated; no victim user interaction is needed (UI:N) and complexity is low (AC:L). Realistic risk is bounded by how backend accounts and module permissions are provisioned in a given installation.

This is a moderate, authenticated integrity issue rather than a high-urgency emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a 5.3 score shows a network-reachable but privilege-requiring flaw: PR:L confirms the attacker must already be an authenticated TYPO3 backend user with access to the mail module. Impact is limited to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect and no scope change (SC:N/SI:N/SA:N), consistent with CWE-74 (improper neutralization / injection) where an operator writes arbitrary page TSconfig. The vuln.today Decision label is this_month, not act_now or emergency. No EPSS score, no CISA KEV listing, and no SSVC fields were supplied, and no public exploit is referenced, so there is no signal of active or imminent widespread exploitation. The main caveat: the input Tags label this 'Information Disclosure', which conflicts with the CVSS vector (VC:N, VI:L) and CWE-74 - the actual risk is unauthorized configuration write/injection, not disclosure; treat the disclosure framing as inaccurate. Realistic priority is patch-this-cycle, driven by the ability of a low-privileged backend user to inject arbitrary page TSconfig, which can broaden their effective control beyond the mail module.

An attacker who already holds a TYPO3 backend account with access to the mail module opens the module's configuration and saves settings; because the submitted values are written to page TSconfig without being restricted to the module's own options, they inject arbitrary page TSconfig directives. No public exploit code is referenced; exploitation is low-complexity (AC:L) but requires an existing authenticated backend session (PR:L).