CVE-2026-77127: CWE-639 Authorization Bypass Through User-Controlled Key in TYPO3 Extension "Modules"

The TYPO3 extension "Modules" contains an authorization bypass vulnerability (CWE-639) in a backend AJAX endpoint for inline editing. The endpoint does not properly restrict access to fields based on the current user's permissions. Consequently, an authenticated backend user with low privileges can supply arbitrary parameters (table, field, record) to trigger error responses that reveal the current database values of requested fields. This can lead to disclosure of sensitive data such as password hashes for backend and frontend users. The vulnerability affects versions >=0 <7.10.4 and >=8.0.0 <8.1.4 of the extension. Exploitation requires an authenticated backend user with access to the extension's backend module.

An attacker with a valid low-privileged TYPO3 backend account can obtain sensitive information, including password hashes, by exploiting the authorization bypass in the extension's AJAX endpoint. This information disclosure could facilitate further attacks such as credential cracking or privilege escalation within the TYPO3 environment. There is no indication of remote unauthenticated exploitation or direct code execution from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user access to trusted personnel only and monitor for suspicious activity related to the extension's backend module. Avoid granting unnecessary backend module access to low-privileged users.