CVE-2026-120329
MediumCVSS 5.3Summary
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Risk Assessment
Arbitrary page TSconfig injection can alter site behavior, affect other features, or be used for further privilege escalation.
Recommendation
Update the mail module to a version that restricts saved settings to allowed module options and limit configuration access to trusted administrators only.
Other vulnerabilities in Mail backend module
See all- CVE-2026-120332Medium
The HTML content of mails and tracked URLs is rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
- CVE-2026-120331Medium
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
Original NVD description (English source)
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS