Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77142Broken Access Control in extension "Industry Directory" (yellowpages2)

High 8.8

In plain English

A high-severity missing authorization in Extension "Industry Directory" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Industry Directory"	8.0.0 – before 8.1.27.0.0 – before 7.0.30 – before 6.1.6

Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-020 vendor-advisory