8.8 High

CVE-2026-118179 Request forgery via news: links

Description

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Thunderbird 159	earliest → < 159	159
Thunderbird 153.6	earliest → < 153.6	153.6

References

bugzilla.mozilla.org bugzilla.mozilla.org
www.mozilla.org www.mozilla.org
www.mozilla.org www.mozilla.org

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 1713 CVEs of Thunderbird →

CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share 7.5 High CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share 5.7 Medium CVE-2026-118177 Calendar discovery accepted local file and remote network share locations 9.1 Critical CVE-2026-118176 Bypass of remote UNC path restriction in mailbox: URLs 8.1 High

Track this CVE