CVE-2026-120328 — Vulnerability intelligence
—
Published:
- CVSS
- 6.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.