Unauthenticated Access Control Vulnerability in TYPO3 Club Directory

A critical broken access control vulnerability (CVE-2026-77141) has been identified in the TYPO3 'Club Directory' extension, version 4.0. The vulnerability originates from a failure to perform ownership checks within the extension's frontend edit, update, and activate actions. Because the application resolves the target club record based on a user-supplied request argument without verifying authorization, an unauthenticated visitor who possesses a valid club record UID can modify existing data or force the publication of records pending approval. This flaw presents a significant risk to data integrity within the TYPO3 CMS environment. Security teams should prioritize patching the extension as directed by the TYPO3 advisory.

Attack Chain

1. Attacker performs reconnaissance to identify TYPO3 instances using the 'Club Directory' extension.
2. Attacker discovers or enumerates valid club record UIDs through public-facing directories or information disclosure.
3. Attacker crafts an HTTP request targeting the extension's frontend update or activate controller actions.
4. Attacker inserts the identified record UID into the appropriate request argument parameter.
5. Attacker transmits the crafted request to the web server, bypassing authentication requirements.
6. The application processes the request, failing to validate ownership of the provided UID.
7. The application performs unauthorized modifications or publishes the target record.
8. Data integrity is compromised, potentially leading to the injection of unauthorized content or destruction of existing records.

Impact

The vulnerability allows unauthenticated users to modify or publish records, which can lead to unauthorized information disclosure, unauthorized content injection, and disruption of site integrity. Given the 8.8 CVSS score, successful exploitation could lead to widespread unauthorized data manipulation across impacted TYPO3 installations that rely on the Club Directory extension for user-managed content.

Recommendation

Prioritize the immediate application of the security patches provided by the TYPO3 project in advisory TYPO3-EXT-SA-2026-019. Detection engineering teams should monitor web access logs for anomalous, high-frequency requests directed toward the Club Directory extension controller actions that include potential record UID parameters.