Extension Modules
Monthly
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.