TYPO3 mail extension EUVD-2026-115741

Exploitation requires the TYPO3 'mail' extension's click-tracking feature to be in use (i.e., newsletters sent with tracked links containing recipient data). The specific trigger per the advisory: the attacker sends a request to the click-tracking middleware with the recipient authentication code omitted entirely - the middleware only validates the code when present, so omission bypasses the check. No authentication, no user interaction, and no special non-default configuration beyond having click tracking enabled are stated as required (AV:N/AC:L/PR:N/UI:N). The main limiting factors are that impact is confined to disclosure of recipient personal data embedded in mail links (no integrity or availability impact, Confidentiality Low), and that the installation must actually use the mail/newsletter click-tracking functionality.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 6.9) in the TYPO3 'mail' extension, rated CWE-639 (authorization bypass via user-controlled key / IDOR). The signals are internally consistent and point to a real but bounded issue: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated access with no user interaction, which matches the description's claim that an attacker simply omits the authentication code to bypass the recipient check. However, impact is explicitly limited - only confidentiality is affected and only at Low (VC:L/VI:N/VA:N), reflecting disclosure of recipient personal data embedded in mail links rather than system compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing, no EPSS score provided, and no public exploit or PoC reference supplied - only the vendor advisory. In short, this is a legitimate privacy/data-protection concern that warrants patching on a normal cycle, not a high-urgency widespread-exploitation emergency; the modest confidentiality impact and absence of exploitation signals argue against treating it as a top-priority incident.

An unauthenticated attacker crafts a request to the click-tracking middleware endpoint and omits the per-recipient authentication code parameter; because the middleware skips validation when the code is absent, the server processes the request and discloses the newsletter recipient's personal data that would normally be embedded in the tracked link. No authentication, user interaction, or elevated privileges are required (AV:N/AC:L/PR:N/UI:N). No public exploit or PoC has been identified at the time of analysis.