TI-2026-53885 Aliases CVE-2026-77142 GHSA-jvr7-mrxh-7jrp

Broken Access Control in extension "Industry Directory" (yellowpages2)

MEDIUM 44CWE-639Published 2026-08-25 · Updated 2026-08-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00406 35th percentileScored 2026-11-07

Fix Fixed Extension "Industry Directory" (TYPO3): 8.1.2, 7.0.3, 6.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TYPO3	Extension "Industry Directory"	8.0.0 to before 8.1.2; 7.0.0 to before 7.0.3; before 6.1.6	8.1.2, 7.0.3, 6.1.6	Patch available	CNA

Extension "Industry Directory" VendorTYPO3 Affected 8.0.0 to before 8.1.2; 7.0.0 to before 7.0.3; before 6.1.6 Fixed in 8.1.2, 7.0.3, 6.1.6 Patch available CNA

Remediation

Fix · CNA Extension "Industry Directory" (TYPO3) Fixed in 8.1.2, 7.0.3, 6.1.6

Timeline

2026-10-02 Threatist record created from CVE-2026-77142
2026-10-03 Alias added: GHSA-jvr7-mrxh-7jrp

References

Advisory 1

https://typo3.org/security/advisory/typo3-ext-sa-2026-020

TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0

See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences