Missing Authorization in TYPO3 extension

MEDIUM 4.3CVE-2020-12698 · GHSA-9pm8-xcj6-2m33 · Published 13/05/2020 · updated 17/06/2026

In short

CVE-2020-12698 is a MEDIUM (CVSS 4.3) vulnerability affecting directmailteam/direct-mail, direct mail (dkd).
Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.0% of all vulnerabilities.
Fix: update to 5.2.4 or later.

Package	Affected versions	Patched versions
directmailteam/direct-mail Packagist	`< 5.2.4`	`5.2.4`
direct mail dkd	`≤ 5.2.3`	No fix yet

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.

NVD description

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 5.2.4

5.2.4

≤ 5.2.3

No fix yet

More vulnerabilities in directmailteam/direct-mail

See all →