CVE-2026-77141

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

CVSS

No CVSS.

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2026-019

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) La extensión resuelve el registro de club objetivo a partir de un argumento de solicitud proporcionado por el usuario en sus acciones de edición, actualización y activación de frontend, pero no realiza ninguna verificación de propiedad en ninguna de ellas. Un visitante no autenticado que conoce el UID de un registro de club puede enviar una solicitud directa a la acción de actualización o activación y sobrescribir ese registro, o publicar uno que aún esté pendiente de aprobación, sin ser su propietario.

Information

Published : 2026-08-25 09:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-77141

Mitre link : CVE-2026-77141

CVE.ORG link : CVE-2026-77141

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-77141", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77141", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:37:04.885758Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"vendor": "TYPO3", "product": "Extension \"Club Directory\"", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.1.3", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "6.0.2", "versionType": "semver"}], "packageName": "jweiland/clubdirectory", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T09:17:34.960", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-019", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it."}, {"lang": "es", "value": "La extensi\u00f3n resuelve el registro de club objetivo a partir de un argumento de solicitud proporcionado por el usuario en sus acciones de edici\u00f3n, actualizaci\u00f3n y activaci\u00f3n de frontend, pero no realiza ninguna verificaci\u00f3n de propiedad en ninguna de ellas. Un visitante no autenticado que conoce el UID de un registro de club puede enviar una solicitud directa a la acci\u00f3n de actualizaci\u00f3n o activaci\u00f3n y sobrescribir ese registro, o publicar uno que a\u00fan est\u00e9 pendiente de aprobaci\u00f3n, sin ser su propietario."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}