Extension Frontend User Registration
Monthly
The TYPO3 'frontend_user_registration' extension trusts an attacker-supplied frontend user identifier in its email-driven action handlers, so unauthenticated remote attackers can confirm registrations, disclose the username and email address of frontend users, and delete arbitrary frontend user accounts without a valid hash. Affected are TYPO3 installations where the extension is installed and active and its email-linked actions (registration confirmation, account deletion) are in use; every version of the extension is listed as affected in the CPE data. No confirmed public exploit code and no CISA KEV entry are identified at time of analysis, but the exploitation profile is unusually accessible (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, assessed CVSS 3.1 8.8 with Integrity:High and Confidentiality:Low), which is why it is prioritised as a near-term 'this week' item rather than a high-score-but-low-reality case.
Mass assignment in the TYPO3 'Frontend User Registration' extension allows unauthenticated remote attackers to assign arbitrary frontend user groups to accounts created or modified via the public registration and profile-edit flows. Because the extension neither restricts which user properties may be submitted nor enforces server-side access control on the group assignment field, an attacker registers or edits an account while injecting a privileged frontend user group identifier, immediately gaining access to content and functionality that would otherwise require elevated membership. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
The TYPO3 'frontend_user_registration' extension trusts an attacker-supplied frontend user identifier in its email-driven action handlers, so unauthenticated remote attackers can confirm registrations, disclose the username and email address of frontend users, and delete arbitrary frontend user accounts without a valid hash. Affected are TYPO3 installations where the extension is installed and active and its email-linked actions (registration confirmation, account deletion) are in use; every version of the extension is listed as affected in the CPE data. No confirmed public exploit code and no CISA KEV entry are identified at time of analysis, but the exploitation profile is unusually accessible (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, assessed CVSS 3.1 8.8 with Integrity:High and Confidentiality:Low), which is why it is prioritised as a near-term 'this week' item rather than a high-score-but-low-reality case.
Mass assignment in the TYPO3 'Frontend User Registration' extension allows unauthenticated remote attackers to assign arbitrary frontend user groups to accounts created or modified via the public registration and profile-edit flows. Because the extension neither restricts which user properties may be submitted nor enforces server-side access control on the group assignment field, an attacker registers or edits an account while injecting a privileged frontend user group identifier, immediately gaining access to content and functionality that would otherwise require elevated membership. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.