Skip to main content

TYPO3 Syssy Extension EUVDEUVD-2026-65345

| CVE-2026-77130 MEDIUM
Insufficient Session Expiration (CWE-613)
2026-08-25 TYPO3 GHSA-j868-6x23-744q
Information Disclosure Extension Syssy Typo3 Monitoring Security Checks
5.3
CVSS 4.0 · Vendor: TYPO3
Share

Severity by source

Vendor (TYPO3) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-accessible but gated behind API key possession (PR:L); no availability impact or scope change; limited confidentiality and integrity effects only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TYPO3).

CVSS VectorVendor: TYPO3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 25, 2026 - 11:01 EUVD
Analysis Generated
Aug 25, 2026 - 09:48 vuln.today

DescriptionCVE.org

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

AnalysisAI

Insufficient JWT expiration validation in the TYPO3 'Syssy - TYPO3 Monitoring & Security Checks' extension allows an attacker already in possession of a valid SYSSY project API key to authenticate using an expired token, bypassing the intended session time boundary (CWE-613). The limited confidentiality and integrity impact (VC:L/VI:L per the CVSS 4.0 vector) reflects access to monitoring and security check data rather than full system compromise. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain SYSSY API key via credential leak or repository exposure
Delivery
Capture previously issued JWT token
Exploit
Wait for token expiration
Execution
Submit expired JWT to Syssy API endpoint
Persist
Bypass expiration validation
Impact
Access monitoring and security check data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to already be in control of a valid API key for the SYSSY project - this is an explicit prerequisite stated in the CVE description and reflected in the PR:L CVSS metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately reflects a medium-severity issue where the principal limiting factor is the PR:L requirement - exploitation is gated behind prior possession of a valid SYSSY project API key. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who previously obtained a valid SYSSY project API key - for example, from an exposed environment variable, source repository secret, or prior credential leak - uses that key to obtain a JWT token from the extension. After the token's expiration time has elapsed, the attacker resubmits it to the extension's API endpoint; because expiration is not validated, the extension accepts the expired token and returns monitoring and security check data. …
Remediation Consult the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-015 and upgrade the Syssy extension to the patched version identified there - no exact fix version is independently confirmed from the provided input data, so the advisory is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Extension Syssy Typo3 Monitoring Security Checks

View all
CVE-2026-77131 MEDIUM
5.3 Aug 25

Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension wh

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-65345 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy