Industry Directory CVE-2026-77142

The vulnerability is exploitable by any unauthenticated network visitor when the TYPO3 Industry Directory extension is installed, the self-service company editing feature is enabled, and the directory is publicly accessible. The attacker must know or enumerate at least one valid company record identifier from the public directory listing - these are exposed by design as part of normal directory browsing. No special configuration, elevated privileges, or user interaction is required. Exploitation is limited to deployments running this specific TYPO3 extension with the frontend editing feature active; organizations that have disabled self-service editing or restricted the directory to authenticated users only are not exposed through this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.8 and signals a network-reachable flaw with no authentication requirement, no attack complexity, and no user interaction needed, placing it firmly in the high-priority tier on structural grounds alone. Integrity impact against the vulnerable system is High (VI:H - company records can be fully overwritten), while confidentiality impact is Low (VC:L - limited to identifiers already visible in the public directory). No CISA KEV listing exists and no public exploit code has been observed, meaning opportunistic mass exploitation is not currently confirmed; however, the attack mechanism is simple enough that any motivated actor with basic HTTP tooling could reproduce it without specialized knowledge. EPSS data is absent from available intelligence, so a probabilistic exploitation estimate cannot be derived. The primary limiting factor is deployment footprint - this is a TYPO3-ecosystem extension, so exposure is bounded to organizations running TYPO3 with this specific extension installed and the frontend editing feature publicly accessible.

An attacker browses the public industry directory, notes the numeric or string identifier of a competitor's or target organization's company record, then crafts a direct HTTP POST request to the extension's write endpoint with that identifier and modified field values - bypassing the UI entirely. Because no authentication or ownership token is validated server-side, the application overwrites the target record with attacker-controlled data. No public proof-of-concept code has been identified, but the attack requires only standard HTTP tooling and knowledge of one valid record identifier.