CVE-2026-77140: TYPO3 Extension "Telephone Directory", заобикаляне на

Описание

Оригинално описание

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Засегнати продукти

• TYPO3 Extension "Telephone Directory": 6.0.0 преди 6.2.0; 5.0.0 преди 5.0.1; преди 4.1.1

Вид слабост

• CWE-862 Missing Authorization
• CWE-639 Authorization Bypass Through User-Controlled Key

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-77140
• https://nvd.nist.gov/vuln/detail/CVE-2026-77140
• https://typo3.org/security/advisory/typo3-ext-sa-2026-018