Auth bypass in Datasolution Acymailing Extension For Joomla
CVE-2026-120471
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected.
Vulnerability class: Broken Access Control
Published · last modified .
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
- Datasolution Acymailing Extension For Joomla — versions 1.0.0-11.1.1
Weakness classification (CWE)
References
- www.acymailing.com/ (product)