CVE-2020-12698
Missing Authorization in TYPO3 extension
CVE-2020-12698 is a medium vulnerability (CVSS 4.3) in Dkd Direct Mail, published May 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 55th percentile. Fixed in directmailteam/direct-mail 5.2.4.
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Record
CVE-2020-12698- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Record
CVE-2020-12698- Updated
- 2026-11-02
EUVDEUVD-2021-1454 No score
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Record
EUVD-2021-1454- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9pm8-xcj6-2m33
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Record
GHSA-9pm8-xcj6-2m33- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-9pm8-xcj6-2m33
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
- Record
GHSA-9pm8-xcj6-2m33- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
directmailteam/direct-mailPackagist |
before 5.2.4 | 5.2.4 |
directmailteam/direct-mailPackagist |
before 5.2.4, plus listed versions 5.05.0.15.1.05.2.05.2.15.2.25.2.3v5.1.1 |
5.2.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |