Admin Approval Bypass in TYPO3 Extension by TYPO3

CVE-2026-77134

What is CVE-2026-77134?

The TYPO3 extension has a security flaw that permits unauthorized users to self-approve accounts awaiting admin approval. This vulnerability arises because the extension does not enforce the use of a dedicated admin confirmation token during the approval process. Instead, it allows any user to leverage a common confirmation hash, which can be easily acquired through the publicly accessible resend-confirmation action. Consequently, this can result in potential privilege escalation and unauthorized access to sensitive functionalities within the system.

References