The click tracking middleware does not validate the authentication code of a recipient if the...

0.71

github-advisories · v1 · published 11/3/2026, 12:31:47 PM · modified 11/3/2026, 12:31:53 PM · TLP:CLEAR

offsec.vulnerability

Source evidence ↗

Entities

cve: CVE-2026-120328cwe: CWE-639ghsa: GHSA-8cvh-5xpf-xwvx

Assessment

Fact summary

low · heuristic

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

Technical delta

low · heuristic

Automated delta unavailable (heuristic mode).

Defensive significance

low · heuristic

None identified (heuristic mode).

Extracted text

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.