CVE-2026-75872: MailerUp 0 to before 1.1.3

Affected technology

MailerUp · 0 to before 1.1.3
maalfer

Description’s affected range: before 1.1.3

Component: Public subscription form
File: backend/apps/forms/views.py

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated remote attackers can have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.