TYPO3: Unauthenticated Account Deletion and Information Disclosure (CVE-2026-120333)

CVE-2026-120333 affects a TYPO3 extension where account-related action links (such as those for registration confirmation or account deletion) fail to properly validate or require a hash parameter. An unauthenticated attacker can exploit this by manipulating the request to target arbitrary frontend users. Successful exploitation results in the unauthorized retrieval of usernames and email addresses, as well as the deletion of frontend user accounts.

Impact

Successful exploitation allows unauthenticated attackers to perform administrative-level actions on frontend user accounts, specifically the retrieval of PII (usernames, email addresses) and the deletion of user accounts.

Recommendation

• Identify all instances of the affected TYPO3 extension within the environment.
• Apply the security update provided by the TYPO3 security team at https://typo3.org/security/advisory/typo3-ext-sa-2026-038.
• Review web server access logs for anomalous HTTP requests targeting registration or deletion confirmation endpoints that lack standard cryptographic hash tokens.