Extension Industry Directory
Monthly
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication requirements and low attack complexity make independent exploitation straightforward against any exposed deployment.
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication requirements and low attack complexity make independent exploitation straightforward against any exposed deployment.