Extension Mail
Monthly
Authenticated TYPO3 backend users with mail-module access can view, change, send and export mails and recipient groups outside their assigned web mounts because the extension's backend actions and AJAX routes omit page-level authorization checks, exposing recipient personal data. The issue is rated CVSS 7.1 and affects the TYPO3 "mail" extension; exploitation requires a valid backend account with mail-module permissions, and no public exploit was identified at time of analysis.
Open redirect in the TYPO3 'mail' extension's click tracking middleware allows an unauthenticated remote attacker to craft a tracking link on a trusted TYPO3 site that forwards victims to an arbitrary external destination, turning the site's own domain into a phishing lure. It is rated CVSS 5.3 (medium) by the vendor and CVSS 4.0 5.3 by the reporting source, with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - the practical impact is limited to integrity of the redirected-to context, so risk is social engineering rather than direct compromise. No public exploit code or PoC is referenced in the available intelligence and the issue is not in CISA KEV; the vendor priority label places it in the this-month remediation window.
TYPO3 sites using the 'mail' extension's newsletter click-tracking can expose recipients' personal data to unauthenticated remote attackers. Requests to the click-tracking middleware that omit the recipient authentication code bypass the validation check, allowing data inserted into tracked newsletter links to be retrieved without credentials or user interaction. The vendor rates the issue medium severity (CVSS 4.0 base 6.9); exploitation is confined to installations that send tracked newsletters containing recipient data, and no public exploit identified at time of analysis.
Saving the backend module configuration of the third-party TYPO3 extension "mail" writes the submitted settings into page TSconfig without restricting them to the module's own configuration keys, allowing arbitrary page TSconfig injection. The flaw affects installations running the extension (CPE cpe:2.3:a:typo3:extension_"mail" with no version bound) and is reachable by a backend user who holds a valid account and has been granted access to the mail module - no victim interaction is required and attack complexity is low, but permissions are required, so it is not unauthenticated. Impact is integrity-only and low (assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit code has been identified at time of analysis, no EPSS score or CISA KEV entry was supplied, and the vuln.today priority decision is this_month rather than an emergency.
The TYPO3 extension "mail" (EXT:mail) performs server-side fetches of content referenced by an "external URL" mail - the message body, its stylesheets and its embedded images - without validating the destination host, allowing server-side request forgery against internal network services. Exploitation requires a valid TYPO3 backend account that holds access to the mail module, so the attacker is an authenticated operator/insider rather than an anonymous outsider; no user interaction is needed and the behaviour is the extension's default. Impact is limited to low-confidentiality disclosure of what internal hosts return, with no integrity or availability effect, and an independent assessment rates the issue moderate with a this-month priority; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the TYPO3 'mail' extension allows an authenticated backend user with access to the mail module to inject arbitrary HTML and JavaScript into mail content or tracked URLs, with execution occurring in another backend user's session when that user views the mail preview or report. The issue is medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), depends on victim interaction, and is limited to backend-user session confidentiality/integrity rather than server compromise or anonymous frontend exposure. No public exploit identified at time of analysis.
Authenticated TYPO3 backend users with mail-module access can view, change, send and export mails and recipient groups outside their assigned web mounts because the extension's backend actions and AJAX routes omit page-level authorization checks, exposing recipient personal data. The issue is rated CVSS 7.1 and affects the TYPO3 "mail" extension; exploitation requires a valid backend account with mail-module permissions, and no public exploit was identified at time of analysis.
Open redirect in the TYPO3 'mail' extension's click tracking middleware allows an unauthenticated remote attacker to craft a tracking link on a trusted TYPO3 site that forwards victims to an arbitrary external destination, turning the site's own domain into a phishing lure. It is rated CVSS 5.3 (medium) by the vendor and CVSS 4.0 5.3 by the reporting source, with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - the practical impact is limited to integrity of the redirected-to context, so risk is social engineering rather than direct compromise. No public exploit code or PoC is referenced in the available intelligence and the issue is not in CISA KEV; the vendor priority label places it in the this-month remediation window.
TYPO3 sites using the 'mail' extension's newsletter click-tracking can expose recipients' personal data to unauthenticated remote attackers. Requests to the click-tracking middleware that omit the recipient authentication code bypass the validation check, allowing data inserted into tracked newsletter links to be retrieved without credentials or user interaction. The vendor rates the issue medium severity (CVSS 4.0 base 6.9); exploitation is confined to installations that send tracked newsletters containing recipient data, and no public exploit identified at time of analysis.
Saving the backend module configuration of the third-party TYPO3 extension "mail" writes the submitted settings into page TSconfig without restricting them to the module's own configuration keys, allowing arbitrary page TSconfig injection. The flaw affects installations running the extension (CPE cpe:2.3:a:typo3:extension_"mail" with no version bound) and is reachable by a backend user who holds a valid account and has been granted access to the mail module - no victim interaction is required and attack complexity is low, but permissions are required, so it is not unauthenticated. Impact is integrity-only and low (assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit code has been identified at time of analysis, no EPSS score or CISA KEV entry was supplied, and the vuln.today priority decision is this_month rather than an emergency.
The TYPO3 extension "mail" (EXT:mail) performs server-side fetches of content referenced by an "external URL" mail - the message body, its stylesheets and its embedded images - without validating the destination host, allowing server-side request forgery against internal network services. Exploitation requires a valid TYPO3 backend account that holds access to the mail module, so the attacker is an authenticated operator/insider rather than an anonymous outsider; no user interaction is needed and the behaviour is the extension's default. Impact is limited to low-confidentiality disclosure of what internal hosts return, with no integrity or availability effect, and an independent assessment rates the issue moderate with a this-month priority; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the TYPO3 'mail' extension allows an authenticated backend user with access to the mail module to inject arbitrary HTML and JavaScript into mail content or tracked URLs, with execution occurring in another backend user's session when that user views the mail preview or report. The issue is medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), depends on victim interaction, and is limited to backend-user session confidentiality/integrity rather than server compromise or anonymous frontend exposure. No public exploit identified at time of analysis.