The TYPO3 extension "Club Directory" fails to perform ownership checks when resolving targeted club records from user-supplied request arguments in its frontend edit, update, and activate actions. This lack of authorization allows unauthenticated visitors who know the UID of a club record to send direct requests to update or activate actions, enabling them to overwrite club records or publish records still awaiting approval without owning them. The vulnerability affects versions prior to 8.1.3 and has a CVSS 4.0 score of 8.8, indicating a high impact with network attack vector, no privileges or user interaction required, but with high impact on integrity.

An attacker can overwrite club records or publish unapproved records without authentication or ownership, compromising data integrity and potentially bypassing approval workflows. This could lead to unauthorized data manipulation and publication of content that should remain restricted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor TYPO3 vendor advisories for updates. Until a fix is available, restrict access to the affected extension or disable it if possible to prevent exploitation.