CVE-2026-77143: CWE-862 Missing Authorization in TYPO3 Extension "Forum"
Description
CVE-2026-77143 is a high-severity vulnerability in the TYPO3 Extension "Forum" that allows unauthorized modification of forum topics. The issue arises because the frontend topic editing process does not verify on the server side whether the visitor owns the topic being edited. An attacker who knows a topic's public identifier can submit update requests to overwrite content without ownership confirmation. This flaw requires no privileged access or special configuration to exploit.
CVSS v4.0
Score 8.8high
Affected software
TYPO3
Extension "Forum"
pkg:composer/jweiland/pforumRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The TYPO3 Extension "Forum" suffers from a missing authorization check (CWE-862) in its frontend topic editing flow. Specifically, the server does not verify that the user requesting a topic modification actually owns that topic. Since topic identifiers are publicly visible, an unauthenticated visitor can craft requests to modify any topic's content arbitrarily. This vulnerability affects versions prior to 6.2.4, including 6.0.0 and 5.0.0. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.
Potential Impact
An attacker can overwrite the content of any forum topic by submitting unauthorized update requests, leading to content tampering without needing any privileges or authentication. This compromises the integrity and availability of forum data, potentially misleading users or disrupting forum operations.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users of the TYPO3 Extension "Forum" should monitor the vendor's advisory for updates. Until a fix is released, consider restricting access to the forum editing functionality or implementing custom authorization checks to verify topic ownership on the server side.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TYPO3
- Date Reserved
- 2026-08-20T13:10:15.962Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8d5b66acd9273b49f365d1
Added to database: 08/25/2026, 09:07:50 UTC
Last enriched: 09/10/2026, 06:37:06 UTC
Last updated: 10/09/2026, 06:48:19 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.