CVE-2026-120331
MediumCVSS 5.3Summary
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Risk Assessment
The SSRF vulnerability can be used to probe and access internal network resources, potentially disclosing information or serving as a foothold for further attacks.
Recommendation
Update the mail module to a version that validates the target host and consider restricting the server's outbound connections to trusted address ranges.
Other vulnerabilities in Mail backend module
See all- CVE-2026-120332Medium
The HTML content of mails and tracked URLs is rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
- CVE-2026-120329Medium
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Original NVD description (English source)
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS