The direct_mail extension up to and including 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
dkd direct mail