Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77143Broken Access Control in extension "Forum" (pforum)

High 8.8

In plain English

A high-severity missing authorization in Extension "Forum" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Forum"	6.0.0 – before 6.2.45.0.0 – before 5.0.10 – before 4.0.4

Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-021 vendor-advisory