PT-2026-136067

CVE-2026-120328

·

Published

2026-11-03

·

Updated

2026-11-03

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2026-120328
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com