CVE-2026-120332
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 03, 2026
Vendor
unknown
Description
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.