Security
AcyMailing 11.1.2 fixes seven Joomla security flaws
AcyMailing 11.1.2 fixes seven front-end security flaws in the Joomla extension, including a high-severity issue that could expose sent campaigns to unauthenticated visitors.
Vendor Acyba released AcyMailing 11.1.2 on 12 November 2026. According to research published by mySites.guru, all versions through and including 11.1.1 are affected.
The flaws comprise six authorization weaknesses and one open redirect. The most serious issue, rated High at 8.7 by mySites.guru, allowed anonymous visitors to read sent campaigns, including unpublished or segment-restricted messages. Other findings included forced unsubscribes, hidden-list enumeration, access-level bypasses and unauthorized subscription changes. The open redirect was rated Medium; the forced-unsubscribe issue was also rated Medium at 6.9. No CVE identifiers have been assigned, and the report does not identify active exploitation.
Administrators should update every installation to 11.1.2 and verify the installed version manually. Some sites may not receive the update through Joomla if their AcyMailing update site disappeared before version 11.1.1. Before updating, mySites.guru recommends setting “Allow subscriber data modifications without authentication” to “No” as a temporary measure.
Originally reported by mySites.guru.