EUVD-2026-65336
GHSA-q34j-6h38-m895
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated POST; no complexity, privileges, or interaction needed; only integrity of employee records is affected.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
AnalysisAI
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The TYPO3 Telephone Directory extension must be installed and have at least one publicly accessible frontend page rendering employee records with discoverable UIDs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) accurately reflects the severity: this is a network-accessible, zero-complexity, unauthenticated integrity violation against any deployment where employee UIDs are discoverable from the frontend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses the public-facing TYPO3 employee directory, extracts employee record UIDs from page URLs or HTML source, then constructs a direct HTTP POST request to the extension's update action endpoint with arbitrary field values - no valid HMAC token required. The update is accepted and persisted, overwriting the targeted employee record with attacker-controlled content. … |
| Remediation | The primary remediation is to apply the vendor-released fix as described in the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-018; no specific patched version number was provided in the available intelligence, so administrators should consult the advisory directly to confirm the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable the TYPO3 Telephone Directory extension on all production instances and confirm removal from active configuration; examine application and web server logs for unauthorized POST requests containing employee UIDs to the extension's data modification endpoints to establish whether tampering has occurred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today