CVE-2026-120328

CVE-2026-120328

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

EPSS exploit prediction

EPSS: 0.006 (46.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Weakness classification (CWE)

References