<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://db.gcve.eu</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Thu, 05 Nov 2026 20:33:18 +0000</lastBuildDate>
    <item>
      <title>CVE-2026-120330 — Broken Access Control in extension "Mail" (mail)</title>
      <link>https://db.gcve.eu/vuln/cve-2026-120330</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; TYPO3 Extension &amp;#34;Mail&amp;#34;&lt;/p&gt;
&lt;p&gt;Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; TYPO3 Extension &amp;#34;Mail&amp;#34;&lt;/p&gt;
&lt;p&gt;Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://db.gcve.eu/vuln/cve-2026-120330</guid>
    </item>
  </channel>
</rss>
