CVE-2026-77141: TYPO3 Extension "Club Directory", заобикаляне на вход

Описание

Оригинално описание

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

Засегнати продукти

• TYPO3 Extension "Club Directory": 8.0.0 преди 8.1.3; 7.0.0 преди 7.0.2; преди 6.0.2

Вид слабост

• CWE-862 Missing Authorization
• CWE-639 Authorization Bypass Through User-Controlled Key

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-77141
• https://nvd.nist.gov/vuln/detail/CVE-2026-77141
• https://typo3.org/security/advisory/typo3-ext-sa-2026-019