EUVD-2026-65348

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77128

TYPO3 extension sf_event_mgt (Event management and registration) has a Broken Access Control vulnerability where the extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-res...

CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-77129

CVE-2026-77129 is a Server-Side Template Injection (SSTI) in the TYPO3 extension Event management and registration (sf_event_mgt). The extension passes an editor-configurable email subject string directly into a Fluid template source without sanitization. A backend user with edit access to the ev...

EUVD-2026-65347

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-77133 Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77133

CVE-2026-77133 is a broken access control vulnerability in the TYPO3 extension femanager . When the profile edit plugin uses its default field configuration, it fails to restrict which frontend usergroups a logged-in user may assign to their own account, enabling self-service privilege escalation...

CVE-2026-77134

CVE-2026-77134 is a Broken Access Control vulnerability in the TYPO3 extension femanager . The extension fails to require the dedicated admin confirmation token when processing an admin-approval request. Instead, a regular user confirmation hash—obtainable by any visitor through the public resend...

CVE-2026-77134 Broken Access Control in extension "femanager" (femanager)

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval...

EUVD-2026-65336

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77140

TYPO3 extension Telephone Directory (telephonedirectory) suffers from a Broken Access Control flaw. The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, but not in the action that persists the change. As a result, an unauthenticated visi...

CVE-2026-77140 Broken Access Control in extension "Telephone Directory" (telephonedirectory)

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...

CVE-2026-77142 Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

EUVD-2026-65335

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...

EUVD-2026-65334

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77141

CVE-2026-77141 is a Broken Access Control vulnerability in the TYPO3 extension Club Directory (clubdirectory). The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions but performs no ownership check in any of them. A...

CVE-2026-77142

CVE-2026-77142 is a Broken Access Control vulnerability in the TYPO3 extension Industry Directory (yellowpages2) . The frontend self-service editing feature hides the edit form using a template-level visibility flag for company records a visitor does not own, but the corresponding server-side wri...

CVE-2026-77141 Broken Access Control in extension "Club Directory" (clubdirectory)

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...

EUVD-2026-65333

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

CVE-2026-77143

CVE-2026-77143 is a broken access control vulnerability in the TYPO3 extension "Forum" (pforum) . The frontend topic editing flow fails to verify on the server side that the requesting visitor actually owns the topic being modified. Because topic identifiers are visible in the public forum listin...