TYPO3 CMS Extension Sends System Info in Cleartext Without OpenSSL
CVE-2026-77131 Published on August 25, 2026
Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
Vulnerability Analysis
CVE-2026-77131 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Cleartext Transmission of Sensitive Information
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Many communication channels can be "sniffed" by attackers during data transmission. For example, network traffic can often be sniffed by any attacker who has access to a network interface. This significantly lowers the difficulty of exploitation by attackers.
Products Associated with CVE-2026-77131
Want to know whenever a new CVE is published for TYPO3? stack.watch will email you.
Affected Versions
Extension "SYSSY - TYPO3 Monitoring & Security Checks":- Before 3.0.6 is affected.