185264 matches found
CVE-2026-77142
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...
CVE-2026-77145
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...
CVE-2026-77143
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...
CVE-2026-77135
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...
CVE-2026-77140
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...
CVE-2026-56093
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...
CVE-2026-56092 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...
CVE-2026-56092
CVE-2026-56092 is a Broken Access Control vulnerability in the Apache Solr for TYPO3 – Enterprise Search extension (solr). During indexer sub-requests, the extension forces empty frontend-group and subpage-inheritance restrictions onto page records. This forged state is then persisted into the sh...
EUVD-2026-65353
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...
CVE-2026-56092 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...
CVE-2026-56092 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...
EUVD-2026-65352
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...
CVE-2026-56093 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...
CVE-2026-56093 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...
CVE-2026-56093
CVE-2026-56093 is a broken access control vulnerability in the TYPO3 extension Apache Solr for TYPO3 – Enterprise Search (solr) . The extension's frontend detail-view document lookup fails to apply the current site's siteHash filter or frontend user access filter , unlike the regular search path....
CVE-2026-56093 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...
CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
CVE-2026-77128
TYPO3 extension sf_event_mgt (Event management and registration) has a Broken Access Control vulnerability where the extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-res...
EUVD-2026-65347
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...