Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-77141 – Broken Access Control / Unauthorized Record Modification – TYPO3 “Club Directory” E

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-77141 is a broken access control vulnerability in the TYPO3 third-party extension "Club Directory" (jweiland/clubdirectory). The extension fails to verify record ownership when processing frontend edit, update, and activate actions, allowing unauthenticated attackers who know (or guess) a club record’s UID to modify or publish that record without authorization. The issue carries a high severity rating (CVSS 8.8) and requires no authentication or user interaction.

Technical details

  • Root cause: The extension’s frontend controller resolves the targeted club record directly from user-supplied request arguments (the record UID) without verifying that the requesting visitor owns or is otherwise authorized to modify that record.
  • Trigger conditions: An attacker only needs to know or enumerate a valid club record UID; no valid session, credentials, or prior interaction with the record is required.
  • Attack vector: Network — the attacker sends direct HTTP requests to the extension’s frontend "edit," "update," and "activate" actions, specifying the target UID as a parameter.
  • Impact: Unauthenticated attackers can overwrite existing club records (integrity impact) or publish/activate records that are still pending approval, bypassing the extension’s intended moderation/approval workflow. No confidentiality or availability impact beyond unauthorized data modification and publication has been confirmed.

Affected software

  • TYPO3 extension Club Directory (jweiland/clubdirectory), versions 0 through 8.1.2 (i.e., all versions prior to 8.1.3)

Severity

  • CVSS Score: 8.8 (High)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
  • CWE-862: Missing Authorization
  • CWE-639: Authorization Bypass Through User-Controlled Key

Mitigation and recommended actions

  • Immediate: Upgrade the "Club Directory" extension to version 8.1.3 or later via the TYPO3 Extension Manager or Composer/Packagist, where ownership verification has been implemented for the frontend edit, update, and activate actions.
  • If immediate patching is not possible:
    • Restrict or disable public frontend access to the club directory’s edit/update/activate plugin actions until the update can be applied.
    • Monitor web server and application logs for unexpected requests to these frontend actions containing arbitrary or sequential UID values, which may indicate exploitation attempts or enumeration.
    • Review recently modified or newly "activated" club records for unauthorized changes following disclosure of this vulnerability.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge