Cpe:2.3:a:typo3:extension:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atypo3extension/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 12:08:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTYPO3: Unauthenticated Account Deletion and Information Disclosure (CVE-2026-120333)https://feed.craftedsignal.io/briefs/2026-11-typo3-extension-account-deletion/Tue, 03 Nov 2026 12:08:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-typo3-extension-account-deletion/A high-severity vulnerability in a TYPO3 extension allows unauthenticated attackers to delete arbitrary frontend user accounts and retrieve sensitive user information by bypassing hash validation on action links.CVE-2026-120333 affects a TYPO3 extension where account-related action links (such as those for registration confirmation or account deletion) fail to properly validate or require a hash parameter. An unauthenticated attacker can exploit this by manipulating the request to target arbitrary frontend users. Successful exploitation results in the unauthorized retrieval of usernames and email addresses, as well as the deletion of frontend user accounts.

Impact

Successful exploitation allows unauthenticated attackers to perform administrative-level actions on frontend user accounts, specifically the retrieval of PII (usernames, email addresses) and the deletion of user accounts.

Recommendation

  • Identify all instances of the affected TYPO3 extension within the environment.
  • Apply the security update provided by the TYPO3 security team at https://typo3.org/security/advisory/typo3-ext-sa-2026-038.
  • Review web server access logs for anomalous HTTP requests targeting registration or deletion confirmation endpoints that lack standard cryptographic hash tokens.
]]>highadvisoryweb-applicationauthentication-bypasscve-2026-120333