TYPO3 Mail Extension EUVD-2026-115737

Exploitation requires an authenticated TYPO3 backend account that has access to the mail module (PR:L); from there the attacker supplies HTML content of mails or tracked URLs that the backend module renders unescaped. Triggering the payload additionally requires a second backend user to view the mail preview or report (UI:P), so execution is not attacker-controlled on its own. Limiting factors: no anonymous/frontend exposure (backend access needed), dependence on victim interaction, and impact scoped to other backend users' sessions rather than the server or unauthenticated visitors. Any TYPO3 installation with the 'mail' extension enabled and multiple backend users is exposed; single-user or non-mail-module deployments face minimal practical risk.

This is a stored cross-site scripting flaw (CWE-79) in the TYPO3 'mail' extension, rated CVSS 4.0 base 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P and impact confined to subsequent-system confidentiality and integrity (SC:L/SI:L), reflecting script execution in another backend user's session rather than direct impact on the vulnerable component itself (VC:N/VI:N/VA:N). The signals are internally consistent and point to a real but bounded risk: exploitation requires a pre-authenticated backend account with access to the mail module (PR:L), and payload execution depends on a second backend user viewing the mail preview or report (UI:P), so this is a privilege-escalation / lateral-movement vector within the TYPO3 backend, not a remote-unauthenticated compromise. No EPSS score, CISA KEV listing, or PoC/exploit reference was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-assigned priority (TYPO3 advisory, Decision label 'this_month') aligns with a Medium-severity authenticated stored-XSS issue that should be patched on a normal cycle rather than as an emergency. The main caveat is that the real impact of SC/SI:L depends on what a compromised higher-privileged backend user (e.g. an administrator viewing the report) could be tricked into doing, which the advisory does not quantify.

A backend user who only holds access to the mail module crafts a mail or a tracked URL whose HTML content embeds malicious JavaScript. Because the backend module renders that HTML unescaped, when another backend user - potentially an administrator - opens the mail preview or report, the attacker's script executes in that victim's authenticated backend session. No public exploit code was provided, but the attack requires only standard mail-module functionality and a victim viewing the affected view.