Vulnerability · Published Aug 25, 2026 · Assigned by TYPO3

CVE-2026-77141Broken Access Control in extension "Club Directory" (clubdirectory)

High 8.8

In plain English

A high-severity missing authorization in Extension "Club Directory" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "Club Directory"	8.0.0 – before 8.1.37.0.0 – before 7.0.20 – before 6.0.2

Weakness: CWE-862, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-019 vendor-advisory