Information disclosure in Datasolution Acymailing Extension For Joomla

CVE-2026-120468

Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.

Vulnerability class: Information Disclosure

Published · last modified .

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Weakness classification (CWE)

References