The TYPO3 Extension "Industry Directory" contains a missing authorization check (CWE-862) in its frontend company self-service editing feature. While the user interface prevents unauthorized users from seeing the edit form for company records they do not own, the backend write operation does not enforce this ownership check. Consequently, an attacker can directly submit crafted update requests for arbitrary company records by specifying their identifiers, bypassing ownership verification and modifying data without permission. This vulnerability affects all versions before 8.1.2 and has a CVSS 4.0 score of 8.8, indicating high severity.

An unauthenticated attacker can overwrite data of any company record in the public directory by submitting unauthorized update requests. This can lead to data integrity compromise and potential misinformation in the directory. There is no indication of privilege escalation or remote code execution, but the unauthorized data modification risk is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected extension or disable the frontend editing feature to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.