Frontend Editing Vulnerability in TYPO3 Product by TYPO3 GmbH
CVE-2026-77142

8.8HIGH

Key Information:

Vendor

Typo3

Status
Extension "industry Directory"
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77142?

The frontend editing feature in TYPO3 relies on a visibility flag to restrict access to editing company records. However, this mechanism fails during server-side write operations. A user can exploit this vulnerability by submitting a crafted update request for a company record they do not own, effectively bypassing ownership validation. This allows unauthorized modification of sensitive data in the application.

Affected Version(s)

Extension "Industry Directory" 0 < 8.1.2

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-020
vendor-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seungbin Yang
Hoja Mustaffa Abdul Latheef
.