Club Directory CVE-2026-77141

The TYPO3 'Club Directory' extension must be installed and its frontend plugin must be active on at least one publicly reachable page. The frontend edit, update, and activate plugin actions must be accessible without a page-level login restriction. No authentication is required - the CVSS 4.0 vector explicitly confirms PR:N (no privileges) and UI:N (no user interaction). The sole practical prerequisite is knowledge of a valid club record UID; since TYPO3 UIDs are sequential auto-incremented integers, an attacker can enumerate them by simply incrementing the parameter value starting from 1. Exploitation is limited to TYPO3 deployments that have this specific extension installed with its frontend plugin exposed publicly; sites that do not use the extension, or that gate all frontend plugin pages behind authentication, are not affected.

The CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N accurately reflects the low-friction exploitation profile - no authentication, no complexity, and no user interaction required, all reachable over the network. The VI:H (high integrity impact to the vulnerable system) is well-justified given that arbitrary record overwrite and unauthorized publication directly corrupt application data. VC:L reflects that the edit form may pre-populate and thus disclose record fields to the attacker. No EPSS score or KEV listing is available in the provided data, so exploitation probability cannot be quantified; however, the vulnerability class - missing authorization on mutable frontend actions - is well-understood, historically common in CMS extensions, and requires minimal attacker skill. The primary prerequisite, knowing a valid record UID, is easily satisfied through sequential enumeration. Real-world risk is meaningful for any TYPO3 deployment running this extension with publicly accessible frontend plugin pages, particularly sites that use the moderation/approval workflow.

An attacker visits a TYPO3 site with the Club Directory plugin active on a public page, then iterates the integer UID parameter (e.g., ?uid=1, ?uid=2) in the plugin's frontend URL to enumerate valid club record IDs. Once a valid UID is identified, the attacker sends a crafted POST request directly to the update action with arbitrary field values - no credentials required - overwriting the club record. For records pending editorial approval, the attacker targets the activate action to force-publish them, bypassing the moderation workflow entirely.