TYPO3 Telephone Directory CVE-2026-77140

The TYPO3 Telephone Directory extension must be installed and have at least one publicly accessible frontend page rendering employee records with discoverable UIDs. No authentication is required - CVSS PR:N confirms unauthenticated exploitation. The critical limiting factor is UID knowledge: the attacker must know or enumerate a valid employee record UID, which is typically exposed in frontend URLs or page HTML when the directory is publicly accessible. Exploitation is limited to integrity impact against employee records; there is no evidence of code execution or data exfiltration potential. Installations where the directory is restricted behind authentication or not publicly exposed are not exploitable remotely.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) accurately reflects the severity: this is a network-accessible, zero-complexity, unauthenticated integrity violation against any deployment where employee UIDs are discoverable from the frontend. The primary real-world impact is data integrity - attackers can silently corrupt or fabricate employee directory entries, which may carry reputational, compliance, or social-engineering consequences. No EPSS data was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. No public exploit code has been identified. Despite the lack of active exploitation signals, the attack complexity is extremely low - even a mid-sized municipal IT team in malbork should treat this as urgent if the extension is publicly exposed, since exploitability requires only HTTP access and knowledge of a UID. The absence of confidentiality and availability impact keeps this from being a full compromise scenario, but the integrity impact on public-facing organizational data warrants prompt patching.

An attacker browses the public-facing TYPO3 employee directory, extracts employee record UIDs from page URLs or HTML source, then constructs a direct HTTP POST request to the extension's update action endpoint with arbitrary field values - no valid HMAC token required. The update is accepted and persisted, overwriting the targeted employee record with attacker-controlled content. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP tooling.