TYPO3 Extension Backend AJAX Field Disclosure
CVE-2026-77127 Published on August 25, 2026
Information Disclosure in extension "Modules" (modules)
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.
Vulnerability Analysis
CVE-2026-77127 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2026-77127 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
Affected Versions
TYPO3 Extension "Modules":- Version 8.0.0 and below 8.1.4 is affected.
- Before 7.10.4 is affected.