The TYPO3 extension "Modules" contains an authorization bypass vulnerability (CWE-639) in a backend AJAX endpoint for inline editing. The endpoint does not properly restrict access to fields based on the current user's permissions. An authenticated low-privileged backend user can manipulate table, field, and record parameters to trigger error responses that disclose the current database value of requested fields. This leads to unauthorized disclosure of sensitive information, including password hashes of backend and frontend users. Exploitation requires an authenticated backend user account with access to the extension's backend module. The vulnerability affects versions =8.0.0, >=8.0.0 <8.1.4, and <7.10.4. No patch or official remediation is currently documented.

An attacker with a valid authenticated TYPO3 backend user account but low privileges can exploit this vulnerability to disclose sensitive information such as password hashes of backend and frontend users by abusing an AJAX endpoint that lacks proper authorization checks. This unauthorized information disclosure could facilitate further attacks or privilege escalation within the TYPO3 environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable extension's backend module to trusted users only and monitor for suspicious activity involving the inline editing AJAX endpoint. Avoid granting backend user accounts unnecessary access to this module.