---
id: CVE-2026-120329
title: Broken Access Control in extension "Mail" (mail)
summary: >-
  Saving the configuration of the mail backend module writes submitted settings
  to the page TSconfig without restricting them to the configuration options of
  the module. Backend users with access to the mail module can write arbitrary
  page…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-74
vendor: TYPO3
product: mediaessenz/mail
affected:
  - mediaessenz/mail >= 4.0.0 < 4.2.0
  - mediaessenz/mail < 3.12.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:23:15.651261Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:31:51.343Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120329'
references:
  - url: 'https://typo3.org/security/advisory/typo3-ext-sa-2026-037'
tags:
  - cve.org
epss: 0.00305
epssPercentile: 0.23375
ingestedAt: '2026-11-05T20:33:06.362Z'
---

## Overview

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

## Affected

- `mediaessenz/mail >= 4.0.0 < 4.2.0`
- `mediaessenz/mail < 3.12.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.