Vulnerability · Published Nov 3, 2026 · Assigned by TYPO3

CVE-2026-120333Broken Access Control in extension "Frontend User Registration" (sf_register)

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in Extension "Frontend User Registration" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Frontend User Registration"	14.0.0 – before 14.0.30 – before 13.2.5

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-038 vendor-advisory