EUVD-2026-65335
GHSA-vxhm-2hqq-3mjf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges or interaction required per description; high integrity impact from unchecked record overwrite; low confidentiality from edit-form data exposure; no availability impact.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
AnalysisAI
Unauthenticated record takeover in the TYPO3 'Club Directory' extension allows any visitor to overwrite or force-publish arbitrary club records by supplying a known record UID in requests to the frontend edit, update, and activate actions. The extension resolves records directly from user-controlled input without performing any ownership or authorization check, making this a textbook CWE-862 (Missing Authorization) / IDOR vulnerability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The TYPO3 'Club Directory' extension must be installed and its frontend plugin must be active on at least one publicly reachable page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N accurately reflects the low-friction exploitation profile - no authentication, no complexity, and no user interaction required, all reachable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker visits a TYPO3 site with the Club Directory plugin active on a public page, then iterates the integer UID parameter (e.g., ?uid=1, ?uid=2) in the plugin's frontend URL to enumerate valid club record IDs. Once a valid UID is identified, the attacker sends a crafted POST request directly to the update action with arbitrary field values - no credentials required - overwriting the club record. … |
| Remediation | Apply the patch documented in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-019; the exact minimum safe version is not independently confirmed from the available CPE data and must be obtained from the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all TYPO3 instances running the Club Directory extension and assess business criticality of club record data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today