CVE WatchSep 10, 2026

CVE-2026-78374

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 10, 2026 · Last modified: Sep 10, 2026 · CWE-201

EPSS · 30d

Not enough EPSS history yet.

Technical description

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).

Official references

www.joomlart.comhttps://www.joomlart.com/t4-builder/t4-joomla-page-builder

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-818047.5 HIG

—

———Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.8h CVE-2026-78303—

—

———Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.14h CVE-2026-870156.8 MED

—

———Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.14h CVE-2026-658126.8 MED

40.4%

——12Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.2d CVE-2026-865053.3 LOW

1.4%

——0In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace3d CVE-2026-864976.8 MED

18.8%

——6In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials3d