{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-120333/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:typo3:extension:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-120333"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TYPO3 extension (typo3-ext-sa-2026-038)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","cve-2026-120333"],"_cs_type":"advisory","_cs_vendors":["TYPO3"],"content_html":"\u003cp\u003eCVE-2026-120333 affects a TYPO3 extension where account-related action links (such as those for registration confirmation or account deletion) fail to properly validate or require a hash parameter. An unauthenticated attacker can exploit this by manipulating the request to target arbitrary frontend users. Successful exploitation results in the unauthorized retrieval of usernames and email addresses, as well as the deletion of frontend user accounts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform administrative-level actions on frontend user accounts, specifically the retrieval of PII (usernames, email addresses) and the deletion of user accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the affected TYPO3 extension within the environment.\u003c/li\u003e\n\u003cli\u003eApply the security update provided by the TYPO3 security team at \u003ca href=\"https://typo3.org/security/advisory/typo3-ext-sa-2026-038\"\u003ehttps://typo3.org/security/advisory/typo3-ext-sa-2026-038\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous HTTP requests targeting registration or deletion confirmation endpoints that lack standard cryptographic hash tokens.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T12:08:58Z","date_published":"2026-11-03T12:08:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-typo3-extension-account-deletion/","summary":"A high-severity vulnerability in a TYPO3 extension allows unauthenticated attackers to delete arbitrary frontend user accounts and retrieve sensitive user information by bypassing hash validation on action links.","title":"TYPO3: Unauthenticated Account Deletion and Information Disclosure (CVE-2026-120333)","url":"https://feed.craftedsignal.io/briefs/2026-11-typo3-extension-account-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-120333","version":"https://jsonfeed.org/version/1.1"}