CVE-2026-77142

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

CVSS

No CVSS.

References

Link	Resource
https://typo3.org/security/advisory/typo3-ext-sa-2026-020

Configurations

No configuration.

History

28 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) La función de edición de autoservicio de la empresa en el frontend se basa en un indicador de visibilidad a nivel de plantilla para ocultar el formulario de edición de los registros de la empresa que un visitante no posee, pero la operación de escritura correspondiente no repite esta verificación de propiedad en el lado del servidor. Como resultado, un visitante que conoce el identificador de un registro de empresa del directorio público puede enviar directamente una solicitud de actualización modificada para ese registro y sobrescribir sus datos, sin que la aplicación confirme nunca que el visitante lo posee.

Information

Published : 2026-08-25 09:17

Updated : 2026-09-28 23:10

NVD link : CVE-2026-77142

Mitre link : CVE-2026-77142

CVE.ORG link : CVE-2026-77142

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-77142", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77142", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:03:42.642471Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"vendor": "TYPO3", "product": "Extension \"Industry Directory\"", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.1.2", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.3", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "6.1.6", "versionType": "semver"}], "packageName": "jweiland/yellowpages2", "collectionURL": "https://packagist.org/", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T09:17:35.133", "references": [{"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-020", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it."}, {"lang": "es", "value": "La funci\u00f3n de edici\u00f3n de autoservicio de la empresa en el frontend se basa en un indicador de visibilidad a nivel de plantilla para ocultar el formulario de edici\u00f3n de los registros de la empresa que un visitante no posee, pero la operaci\u00f3n de escritura correspondiente no repite esta verificaci\u00f3n de propiedad en el lado del servidor. Como resultado, un visitante que conoce el identificador de un registro de empresa del directorio p\u00fablico puede enviar directamente una solicitud de actualizaci\u00f3n modificada para ese registro y sobrescribir sus datos, sin que la aplicaci\u00f3n confirme nunca que el visitante lo posee."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}