TYPO3 frontend_user_registration EUVD-2026-115736

Exploitation requires that the TYPO3 'frontend_user_registration' extension be installed and active and that its email-driven actions (e.g. registration confirmation and account-deletion links) are in use, since the flaw is that these action handlers do not reject requests with a missing or invalid hash and instead trust the frontend user supplied in the request. No authentication, privileges, or user interaction are required (PR:N/UI:N), and default exploitation works against reachable sites running the affected extension. The practical limiting factors are therefore the presence of this specific extension and the attacker needing a valid target frontend-user identifier (which the same flaw helps enumerate); there is no non-default configuration or special platform requirement called out in the evidence.

This is a genuine near-term priority rather than a high-CVSS-but-low-real-risk case, driven by an unusually accessible exploitation profile. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, and CWE-639 (authorization bypass through a user-controlled key) matches the description precisely: the email action links fail to validate the hash and trust the frontend user supplied in the request. Impact is split - confidentiality is limited (VC:L: disclosure of email/username) but integrity is high (VI:H: deletion of arbitrary frontend user accounts), with no availability impact (VA:N). The vendor-assigned priority is 'this_week', consistent with the easy, unauthenticated reach. Key signals are MISSING and should temper absolute urgency: there is NO CISA KEV listing, NO EPSS score provided, and NO verified exploit code - the only reference is the TYPO3 vendor advisory, so exploitation is not confirmed in the wild. The conflict to note explicitly: the technical ease of exploitation is high, but there is no evidence of active exploitation or public weaponization at time of analysis, so this is best treated as a high-likelihood-if-targeted issue to patch this week, not a declared emergency.

An unauthenticated attacker crafts a request to one of the extension's email-action endpoints (such as the registration-confirmation or account-deletion link) but omits or falsifies the validation hash, supplying the identifier of a chosen active frontend user. Because the backend trusts the supplied user instead of rejecting the bad hash, the attacker can enumerate email addresses and usernames of all frontend users and delete arbitrary accounts. No public exploit was identified at time of analysis; only the vendor advisory is referenced.