CVE-2026-120330 in Mail
Summary
by MITRE • 11/03/2026
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability described constitutes a critical Broken Access Control flaw within the backend interface of the mail module, specifically affecting both standard HTTP actions and Asynchronous JavaScript and XML (AJAX) endpoints. This security deficiency arises from an insufficient validation mechanism that fails to verify whether the authenticated backend user possesses legitimate access rights to the specific page or recipient group associated with the requested email data. In a properly secured system, every request targeting sensitive resources must undergo rigorous authorization checks against the user's assigned web mounts and permission sets. However, in this instance, the application logic relies on the assumption that mere module-level access grants broad privileges over all contained entities, ignoring granular page-level restrictions defined by the content management framework.
From a technical perspective, the root cause lies in the absence of object-level security checks during the processing of backend actions and AJAX routes. When a user initiates an action such as viewing, modifying, sending, or exporting mail records, the server-side code retrieves data based on identifiers provided in the request without cross-referencing these identifiers against the current session's authorized page tree. This oversight allows attackers to manipulate parameters, such as changing record IDs or recipient group identifiers, to access resources located outside their designated web mounts. The vulnerability is particularly severe because it affects both synchronous and asynchronous communication channels, meaning that even dynamic interface updates triggered by client-side scripts are susceptible to exploitation without requiring complex user interaction beyond the initial authenticated session establishment.
The operational impact of this vulnerability is significant, primarily due to the sensitive nature of the data involved. Since mail systems typically store personal identifiable information (PII) such as names, email addresses, and potentially other contact details within recipient groups, unauthorized access leads directly to a breach of confidentiality for these individuals. An attacker with basic backend user privileges can bypass administrative boundaries to exfiltrate large volumes of private customer or employee data through the export functionality. Furthermore, the ability to change and send mails introduces risks beyond mere data leakage; it enables potential spam campaigns, phishing attacks using trusted sender addresses, and manipulation of communication logs for malicious purposes. This effectively compromises the integrity and availability aspects of security alongside confidentiality.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, where a user is able to access or modify data that they are not authorized to do so. Additionally, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate credentials but abuses their permissions through privilege escalation via broken object-level authorization. The scenario also reflects CWE-639, Authorization Bypass Through User-Controlled Key, where the attacker controls the key (the mail or recipient ID) to bypass security checks.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict server-side validation for all backend actions and AJAX endpoints within the mail module. Developers must ensure that every request retrieves data only if the associated resource is explicitly contained within one of the user's authorized web mounts. This involves querying the access control lists or permission matrices to verify ownership before processing any view, edit, send, or export operation. Additionally, implementing consistent authorization middleware across all routes ensures that no endpoint bypasses these checks due to architectural oversights. Regular security audits and penetration testing focusing on horizontal privilege escalation should be conducted to identify similar gaps in other modules where resource-level permissions are not strictly enforced against user-specific mount points.