Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77140Broken Access Control in extension "Telephone Directory" (telephonedirectory)

High 8.7

In plain English

A high-severity missing authorization in Extension "Telephone Directory" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Telephone Directory"	6.0.0 – before 6.2.05.0.0 – before 5.0.10 – before 4.1.1

Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-018 vendor-advisory