CVE-2026-77140

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

CVSS

No CVSS.

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2026-018

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) La extensión valida el HMAC de un enlace de edición de empleado de frontend solo en la acción que renderiza el formulario de edición, no en la acción que persiste el cambio. Un visitante no autenticado que conoce el UID de un registro de empleado visible puede enviar una solicitud POST directa a la acción de actualización y sobrescribir ese registro sin un enlace de edición válido ni ninguna verificación de propiedad.

Information

Published : 2026-08-25 09:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-77140

Mitre link : CVE-2026-77140

CVE.ORG link : CVE-2026-77140

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-77140", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77140", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:04:07.705844Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"vendor": "TYPO3", "product": "Extension \"Telephone Directory\"", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.2.0", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.1", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "4.1.1", "versionType": "semver"}], "packageName": "jweiland/telephonedirectory", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T09:17:34.807", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-018", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check."}, {"lang": "es", "value": "La extensi\u00f3n valida el HMAC de un enlace de edici\u00f3n de empleado de frontend solo en la acci\u00f3n que renderiza el formulario de edici\u00f3n, no en la acci\u00f3n que persiste el cambio. Un visitante no autenticado que conoce el UID de un registro de empleado visible puede enviar una solicitud POST directa a la acci\u00f3n de actualizaci\u00f3n y sobrescribir ese registro sin un enlace de edici\u00f3n v\u00e1lido ni ninguna verificaci\u00f3n de propiedad."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}