CVE-2026-28181

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Broken Access Control vulnerability in AcyMailing SMTP Newsletter up to version 10.11.1 allows a subscriber to gain unauthorized access to administrative functions.

Risk Assessment

Subscribers may access sensitive functions, potentially leading to data integrity issues or unauthorized configuration changes.

Recommendation

Update the AcyMailing SMTP Newsletter plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.