CVE-2026-120332
MediumCVSS 5.1Summary
The HTML content of mails and tracked URLs is rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
Risk Assessment
An attacker can execute malicious script in other administrators' browsers (stored XSS), potentially leading to session hijacking or unauthorized actions in the admin panel.
Recommendation
Update the mail module to a version containing the HTML escaping fix and, if necessary, restrict access to the mail module to trusted backend users only.
Other vulnerabilities in Mail backend module
See all- CVE-2026-120331Medium
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
- CVE-2026-120329Medium
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Original NVD description (English source)
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS