CVE-2026-120467

{
  "etk_id": "ETK-2026-4319",
  "cve_id": "CVE-2026-120467",
  "display_id": "CVE-2026-120467",
  "ghsa_id": "GHSA-r3wx-qjqf-657f",
  "euvd_id": "EUVD-2026-124610",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing subscriber ownership checks in AcyMailing",
  "summary": "AcyMailing for Joomla and WordPress versions 1.0.0 through 11.1.1 are affected by an authorization flaw in subscriber list actions. An authenticated user at any privilege level can alter another subscriber's mailing-list enrollment. Exploitation requires an account on the affected site.",
  "mitigation": "Remove or tightly limit untrusted authenticated accounts, and restrict subscriber-management access to trusted administrators where possible. Review mailing-list membership changes for unauthorized activity and apply a vendor update when a corrected release is published.",
  "vendor": "Datasolution",
  "product": "AcyMailing extension for Joomla and WordPress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0.0-11.1.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AcyMailing extension for Joomla and WordPress",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.381479766666667,
  "t0_at": "2026-11-12T18:03:37.539000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T18:03:37.539000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T18:03:37.539000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120467"
    }
  }
}