TYPO3 Mail Extension EUVD-2026-115739

Exploitation requires an authenticated TYPO3 backend user who has been granted access to the mail module (PR:L). The specific flaw is that the mail module's backend actions and ajax routes do not verify whether the backend user's web mounts include the page of the requested mail or recipient group, so a user with legitimate mail-module access can reach mails and recipient groups outside their assigned web mounts. The limiting factors are therefore: a valid backend account is needed, that account must have mail-module access, and only mails/recipient groups managed through this extension are affected - there is no remote unauthenticated path. No special non-default configuration or user interaction is required beyond having the mail extension installed and the user holding mail-module permissions.

This is a broken-access-control flaw (CWE-862, missing authorization) in the TYPO3 'mail' extension, rated CVSS 7.1 via the vendor's 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N). The high score is driven by VC:H - exposure of recipients' personal data across web-mount boundaries - but the real-world risk is tempered by the PR:L requirement: the attacker must already be an authenticated TYPO3 backend user who has been granted access to the mail module. There is no KEV listing and no EPSS score in the provided data, and no public exploit or PoC reference is supplied, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_week', indicating moderate but not emergency urgency. The dominant risk is insider/over-privileged-editor abuse and GDPR-relevant personal-data exposure rather than mass remote compromise; the low integrity (VI:L) and null availability (VA:N) impacts reflect that attackers can read, alter, send and export mails/recipient groups but cannot fully take over the system. EPSS and KEV data are absent from the input and should be checked directly against current feeds before final prioritization.

A TYPO3 backend editor who legitimately has access only to their own site section (web mount) and the mail module navigates to the mail module's backend or ajax routes and references the page UID or recipient group of a mail belonging to another part of the installation. Because the access check against the backend user's web mounts is missing, the editor can view, modify, send and export those out-of-scope mails and recipient groups, harvesting recipients' personal data. No public exploit code is identified at time of analysis; exploitation requires an authenticated backend account with mail-module access.