CVE-2026-120040

Name of the Vulnerable Software and Affected Versions Mail logging & Catcher versions prior to 2.2.1

Description Sensitive information exposure occurs via the message parameter. Authenticated attackers with subscriber-level access or higher can extract valid administrator password-reset keys from stored email logs. This allows them to complete the password-reset process and escalate privileges to the administrator level. This issue is exploitable if the default view role setting is configured to a capability held by low-privileged users, such as read.

Recommendations Update to a version newer than 2.2.0. Restrict the default view role setting to manage options to ensure log access is limited to administrators.