CVE-2026-77142: CWE-862 Missing Authorization in TYPO3 Extension "Industry Directory"

The TYPO3 Extension "Industry Directory" contains a missing authorization vulnerability (CWE-862) where the server-side write operation fails to confirm ownership of company records before processing updates. Although the frontend interface hides edit forms for unauthorized users, the backend does not enforce this restriction, allowing unauthorized visitors to modify records by submitting crafted update requests with known identifiers. This vulnerability affects versions 7.0.0, 8.0.0, and all versions prior to 8.1.2. The CVSS 4.0 score is 8.8, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on integrity.

An attacker can overwrite company record data in the public directory without owning the record, potentially leading to data tampering and misinformation. This compromises data integrity and trustworthiness of the directory content. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Industry Directory extension or implement additional server-side authorization checks to verify ownership before processing update requests.