The TYPO3 extension "Telephone Directory" suffers from a missing authorization check (CWE-862) in its update action. While the extension validates the HMAC token when rendering the edit form, it fails to do so when processing the update request. Consequently, an unauthenticated attacker can overwrite employee records by sending crafted POST requests with known UIDs, bypassing any ownership or edit link validation.

An attacker can modify employee records in the telephone directory without authentication or authorization, potentially leading to unauthorized data tampering. This could affect data integrity and trustworthiness of the directory information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the extension or implement additional access controls to prevent unauthorized POST requests to the update action.