TYPO3 Frontend User Registration CVE-2026-46721

The TYPO3 Frontend User Registration extension must be installed and active on the target site, and at least one page hosting the registration or account-edit form must be publicly reachable without prior authentication. Exploitation is limited to the scope of frontend user group privileges - it does not affect TYPO3 backend (administrator) accounts or server-level access. The attacker must know or enumerate a valid frontend user group ID to target; however, group IDs in TYPO3 are typically small sequential integers, making enumeration trivial. No special configuration beyond the extension's default registration flow is required. The attack is bounded to instances where meaningful access control is enforced via frontend user groups; sites that do not use group-gated content are unaffected in practice despite being technically vulnerable.

The CVSS 4.0 base score of 6.9 reflects medium severity, with low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. The vector AV:N/AC:L/AT:N/PR:N/UI:N indicates the attack is trivially automatable against any publicly accessible instance of the extension - no authentication, no user interaction, no special attack conditions. However, the actual blast radius is deployment-dependent: impact escalates significantly in installations where privileged frontend user groups gate access to sensitive paid content, customer portals, internal documentation, or premium functionality. No EPSS score was provided in the input data, preventing a probabilistic exploitation likelihood assessment. This CVE is not in the CISA KEV catalog and no POC is identified at time of analysis, suggesting exploitation is theoretical rather than active. Despite a moderate CVSS score, the PR:N/AC:L combination makes this a meaningful horizontal privilege escalation risk in any TYPO3 site using frontend user group restrictions as an access control boundary.

An attacker navigates to a publicly accessible TYPO3 registration or account-edit page, intercepts or crafts the HTTP POST request using a browser dev tool or proxy, and appends or modifies the frontend user group parameter (e.g., fe_groups) to reference the ID of a privileged group - such as one granting access to a paid content area or internal portal. Upon form submission, the server processes the unsanitized input, assigns the attacker's account to the targeted group, and the attacker immediately authenticates with elevated frontend privileges. No public exploit code is identified at time of analysis, but the technique requires only basic HTTP manipulation skills.