TYPO3 Forum EUVD-2026-65333

No special conditions are required. Topic identifiers are visible to any visitor in the standard public forum listing, providing the only prerequisite for targeting a specific post. The CVSS 4.0 vector (PR:N, UI:N, AT:N) confirms exploitation is possible without authentication, without user interaction, and without any non-default server configuration. The sole limiting factor is that the target TYPO3 instance must have the Forum extension installed and the forum must be publicly accessible over the network - base TYPO3 installations without this extension are unaffected. There is no known platform, OS, or deployment-mode restriction beyond extension presence.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, network-reachable flaw requiring no attack prerequisites, no authentication, and no user interaction - placing it firmly in the high-priority tier for any TYPO3 deployment running the Forum extension. The integrity impact (VI:H) is significant: an attacker can silently replace legitimate forum content at scale. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in the CISA KEV catalog, so active exploitation has not been confirmed. However, the trivial exploit mechanics - simply replaying an edit request with an arbitrary topic ID - mean weaponization requires minimal skill. The absence of a KEV listing and POC reduces urgency slightly relative to the raw score, but the low barrier to exploitation warrants prompt remediation rather than risk-acceptance.

An attacker browses the public forum, collects topic identifiers from the listing page, and selects a target post such as a pinned announcement or a support thread. Using browser developer tools or an HTTP proxy, the attacker captures a valid edit request, substitutes the target topic's identifier, and submits crafted replacement content - the server applies the change without any ownership verification. No public exploit code was identified at time of analysis, but the attack requires only basic HTTP interception skills and no specialized knowledge.