Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-120468 EUVD-2026-124609GHSA-hpx9-mrvx-g6r5

Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by Joomla

Description

Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.

Affected products

VendorProductAffectedFixed
Datasolution AcyMailing extension for Joomla 1.0.0-11.1.1 —

References