https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T07:29:52.013176+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120330 fkie_cve-2026-120330 2026-11-05T07:29:52.015753+00:00

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.

 https://db.gcve.eu/vuln/ghsa-2xxv-cj6j-pj6f GHSA-2xxv-cj6j-pj6f 2026-11-05T07:29:52.015857+00:00

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.