EUVD-2026-65348
GHSA-75q8-x7vq-6h5p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network AJAX endpoint requires only low-privilege backend auth; no scope change; high confidentiality from hash disclosure; zero integrity or availability impact.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.
AnalysisAI
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated TYPO3 backend user account - a low-privileged role such as content editor is sufficient - and access to the affected extension's backend module as granted by the user's backend group configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N reflects a bounded but meaningful risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a content-editor TYPO3 backend account uses browser developer tools or a proxy to intercept the AJAX request format used by the inline editing feature, then crafts a modified request targeting the be_users table with the password field and the record ID of a known administrator account. The endpoint processes the request without verifying the editor's permissions for that table or field, and the resulting error response includes the administrator's stored password hash. … |
| Remediation | Consult TYPO3 security advisory TYPO3-EXT-SA-2026-016 at https://typo3.org/security/advisory/typo3-ext-sa-2026-016 for the specific patched extension version and apply the vendor-released update as the primary remediation; an exact fix version number is not confirmed from the available intelligence and must be verified at the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today