TYPO3 CMS: Missing Ownership Check Enables Company Record Overwrite
CVE-2026-77142 Published on August 25, 2026

Broken Access Control in extension "Industry Directory" (yellowpages2)
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-77142 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Types

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-77142 has been classified to as an AuthZ vulnerability or weakness.

What is an Insecure Direct Object Reference / IDOR Vulnerability?

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

CVE-2026-77142 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.


Affected Versions

TYPO3 Extension "Industry Directory":