TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...

TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...

TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...

TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...

TYPO3-EXT-SA-2026-023: Broken Access Control in extension "Event management and registration" (sf_event_mgt)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

EUVD-2026-65173

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

EUVD-2026-65168

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

EUVD-2026-65160

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

PT-2026-81873

Name of the Vulnerable Software and Affected Versions GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 Description Broken access control in the IP lock manager allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts. This is...

PT-2026-82029

Mattermost doesn't require role-management authorization when setting the scheme admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...

CVE-2026-38474

The software GazellePW (GazellePosterWall) , specifically commit 86c4bedf727691b5a97af42a4864869d18446449 , contains a Broken access control vulnerability within the IP lock manager. This flaw allows remote authenticated users to perform unauthorized actions, such as adding, modifying, or deletin...

PT-2026-81870

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

PT-2026-81241

Name of the Vulnerable Software and Affected Versions Club Directory affected versions not specified Description Broken access control exists in the frontend edit, update, and activate actions. The extension resolves the targeted club record from a user-supplied request argument but fails to...

PT-2026-81245

Name of the Vulnerable Software and Affected Versions Events 2 affected versions not specified Description Broken access control exists in the frontend management update flow. The system verifies a different event than the one actually being modified, allowing a user with frontend event managemen...

CVE-2026-38470

A broken access control vulnerability exists in the API user endpoint of GazellePW (GazellePosterWall) , specifically within commit 86c4bedf727691b5a97af42a4864869d18446449. This flaw allows unprivileged, authenticated users to enable or disable arbitrary user accounts by using the req=disable or...