TYPO3 Ext HMAC Bypass Allows Unauth Record Overwrite
CVE-2026-77140 Published on August 25, 2026

Broken Access Control in extension "Telephone Directory" (telephonedirectory)
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-77140 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Types

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-77140 has been classified to as an AuthZ vulnerability or weakness.

What is an Insecure Direct Object Reference / IDOR Vulnerability?

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

CVE-2026-77140 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.


Affected Versions

TYPO3 Extension "Telephone Directory":