Summary
CVE-2026-77142 is a high-severity missing authorization vulnerability affecting the "Industry Directory" TYPO3 extension (Composer package jweiland/yellowpages2). The frontend company self-service editing feature relies solely on client-side visibility controls to determine who may edit a company record, and the server-side update handler does not verify that the requester actually owns the record being modified. As a result, any unauthenticated visitor who can obtain or guess a company record’s identifier from the public directory can submit a crafted update request and overwrite that company’s data, a flaw rated 8.8 (High) under CVSS v4.0.
Technical details
- Root cause: The extension hides the frontend edit form for company records the current visitor does not own using a template-level (client-side) visibility flag only; the corresponding server-side write/update action performs no equivalent ownership check.
- Trigger conditions: An attacker needs only the identifier of a company record, obtainable from the extension’s public-facing directory listing, to construct a direct update request against a record they do not control.
- Attack vector: Network-based, unauthenticated, low complexity — no user interaction and no privileges are required (per the CVSS vector: AV:N/AC:L/AT:N/PR:N/UI:N).
- Impact: Unauthorized modification (integrity impact rated High) of company directory records belonging to other organizations; no confirmed impact to confidentiality or availability of the affected records per the published vector.
Affected software
- TYPO3 Extension "Industry Directory" (Composer package
jweiland/yellowpages2) - Versions 0 through 8.1.1 (all releases prior to 8.1.2)
Severity
- CVSS v4.0 Base Score: 8.8 (High)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - CWE-862: Missing Authorization
- CWE-639: Authorization Bypass Through User-Controlled Key
Mitigation and recommended actions
- Immediate: Upgrade the
jweiland/yellowpages2extension to version 8.1.2 or later, which adds server-side ownership validation on the company record update action, via Composer/TYPO3 Extension Manager. - If immediate patching is not possible:
- Disable or restrict the frontend company self-service editing feature until the update can be applied.
- Review company directory records for unexpected or unauthorized modifications.
- Restrict network exposure of the affected TYPO3 frontend endpoints where feasible, and monitor for anomalous update requests referencing company record identifiers not associated with the requesting session.

