{"action":"Upgrade in2code/powermail to 12.5.3 or later.","affected":[{"fixed":"12.5.3","introduced":"12.0.0"},{"fixed":"13.0.1","introduced":"13.0.0"}],"component":"in2code/powermail","cve_ids":["CVE-2025-7899"],"ecosystem":"Packagist","epss":0.0033,"exploited":false,"fixed_versions":["12.5.3","13.0.1"],"ghsa_id":"GHSA-x769-3cwv-f8hc","id":"tcs_01M5KFASEJJQRV1828TXS02KE2","modified_at":"2025-07-22T14:57:26.458504Z","published_at":"2025-07-22T12:30:43Z","references":["https://osv.dev/vulnerability/GHSA-x769-3cwv-f8hc","https://nvd.nist.gov/vuln/detail/CVE-2025-7899","https://github.com/in2code-de/powermail/commit/b39e129c5e2a797f0ccf271fea220c7933ca77bc","https://github.com/in2code-de/powermail","https://typo3.org/security/advisory/typo3-ext-sa-2025-009"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-x769-3cwv-f8hc","url":"https://osv.dev/vulnerability/GHSA-x769-3cwv-f8hc"}],"summary":"Powermail extension for TYPO3 allows Insecure Direct Object Reference"}