Description
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Telephone Directory" | 6.0.0 – < 6.2.0, 5.0.0 – < 5.0.1, < 4.1.1 | 6.2.0 |
Advisories 1
- WID-SEC-2026-3003 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 25, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-018 vendor-advisory