Insecure Direct Object Reference in extension "powermail" (powermail)

published 2025-07-22 15 mo ago modified 2026-06-17 4 mo ago also GHSA-x769-3cwv-f8hc , EUVD-2025-22306

cvss: 6.0; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Patch / fix

fixed in 1 links 1

packagist in2code/powermail 12.5.3, 13.0.1

github.com/in2code-de/powermail@b39e129 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 15 mo ago (2025-07-22)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.0	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.0	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
packagist	in2code/powermail	>=12.0.0, <12.5.3 >=13.0.0, <13.0.1	12.5.3 13.0.1

Affected products

TYPO3 Extension "powermail"

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

CVE List CVE-2025-7899
GitHub Advisory GHSA-x769-3cwv-f8hc
NVD CVE-2025-7899

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary