EUVD-2026-65334
GHSA-jvr7-mrxh-7jrp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication; record IDs are publicly visible (C:L); write operations overwrite arbitrary records (I:H); no availability impact.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.
AnalysisAI
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is exploitable by any unauthenticated network visitor when the TYPO3 Industry Directory extension is installed, the self-service company editing feature is enabled, and the directory is publicly accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.8 and signals a network-reachable flaw with no authentication requirement, no attack complexity, and no user interaction needed, placing it firmly in the high-priority tier on structural grounds alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses the public industry directory, notes the numeric or string identifier of a competitor's or target organization's company record, then crafts a direct HTTP POST request to the extension's write endpoint with that identifier and modified field values - bypassing the UI entirely. Because no authentication or ownership token is validated server-side, the application overwrites the target record with attacker-controlled data. … |
| Remediation | Apply the patched version of the Industry Directory extension as specified in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-020; an exact fix version is not independently confirmed from available data beyond the vendor advisory reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of the TYPO3 Industry Directory extension deployed in your environment and either disable the extension entirely or restrict frontend access to the record edit form using authentication requirements or network-level controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today