← CVE Intelligence

CVE-2026-77140

Broken Access Control in extension "Telephone Directory" (telephonedirectory) PUBLISHED

Description (CNA)

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Affected (CNA)

Vendor / productVersions
TYPO3 / Extension "Telephone Directory"affected 6.0.0 before 6.2.0; affected 5.0.0 before 5.0.1; affected 0 before 4.1.1

CWE

CWE-862, CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.