CVE-2025-7899 MEDIUM

CVE-2025-7899: Insecure Direct Object Reference in extension "powermail" (powermail)

Vendor Typo3
Product Extension "powermail"
Weakness CWE-639 · IDOR
Published July 22, 2025
Last update July 22, 2025
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Key dates

02Disclosure timeline

July 22, 2025 CVE published
July 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42725 WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API CVE-2024-8040 Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x CVE-2026-7665 Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler CVE-2026-27705 Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch