TYPO3 mail extension CVE-2026-120331

Requires an authenticated TYPO3 backend user who has access to the mail module (EXT:mail); this is an operator/insider-level prerequisite, not anonymous access. The attacker then supplies an 'external URL' mail whose body content, referenced stylesheets, or embedded images point to an attacker-chosen internal host - the server fetches these targets without validating the destination host (CWE-918), which is the exact triggering condition. Limiting factors that reduce realistic risk below the raw network vector: a valid backend account with mail-module rights is mandatory (PR:L), so the exploit is unavailable to unauthenticated outsiders; there is no user-interaction requirement and it works against the extension's default behaviour. Impact is bounded to reaching internal hosts with low confidentiality disclosure and no integrity or availability effect.

This is a genuine but moderate-priority issue, not a high-CVSS-but-low-real-risk artifact and not an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (medium): the flaw is reachable over the network with low attack complexity and no user interaction, but it is NOT exploitable by an anonymous attacker - PR:L means a valid, authenticated TYPO3 backend account with access to the mail module is required, which materially limits the realistic attacker population to insiders or anyone who has already obtained backend credentials. Impact is constrained: VC:L/VI:N/VA:N plus subsequent-system SC:L reflect a server-side request forgery that can reach and probe internal hosts (low confidentiality gain, no integrity or availability impact). No EPSS score, CISA KEV listing, or public PoC is present in the supplied data, and the vuln.today decision label is 'this_month' rather than act_now/emergency - all of these align with a standard-cycle patch rather than urgent remediation. The signals are mutually consistent (authenticated-only SSRF, limited impact, no evidence of exploitation); no conflicting indicators were found, though the absence of EPSS/KEV/PoC data means exploitation likelihood is unquantified rather than confirmed-low.

An authenticated backend user holding access to the TYPO3 mail module creates or configures an 'external URL' mail and points the content, stylesheet, or embedded-image URLs at an internal host (e.g. http://169.254.169.254/ or an internal admin service). Because the server fetches those targets without validating the destination host, it issues the requests on the attacker's behalf, enabling internal-network reconnaissance and access to services not reachable from outside. No public exploit identified at time of analysis; exploitation requires only standard mail-module functionality against a default configuration.