Typo3 · Powermail · CVE-2024-47047
**Name of the Vulnerable Software and Affected Versions**
powermail extension versions prior to 7.5.1
powermail extension versions prior to 8.5.1
powermail extension versions prior to 10.9.1
powermail extension versions prior to 12.4.1
**Description**
An issue was discovered in the powermail extension for TYPO3, where it fails to validate the `mail` parameter of the `createAction`, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms persisted by the extension.
**Recommendations**
For versions prior to 7.5.1, update to version 7.5.1 or later.
For versions prior to 8.5.1, update to version 8.5.1 or later.
For versions prior to 10.9.1, update to version 10.9.1 or later.
For versions prior to 12.4.1, update to version 12.4.1 or later.