The TYPO3 Extension "Frontend User Registration" suffers from improper access control and insufficient validation of user-submitted properties during account creation and editing. Specifically, it does not restrict which frontend user groups can be assigned, enabling attackers to escalate privileges by assigning themselves to privileged user groups. This vulnerability is tracked as CVE-2026-46721 and is categorized under CWE-915 (Improper Control of Dynamically-Managed Code Resources). The CVSS 4.0 score is 6.9, indicating a medium severity level. No patch or official fix has been documented in the provided data.

An attacker exploiting this vulnerability can assign arbitrary frontend user groups to their account during registration or editing, thereby gaining unauthorized access to restricted content and functionality intended only for privileged frontend user groups. This could lead to privilege escalation within the TYPO3 environment, compromising the integrity of access controls on the affected extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the frontend user registration and editing features or implementing custom validation controls to enforce proper user group assignments. Monitor TYPO3 vendor advisories for updates regarding patches or official mitigations.