TYPO3 vulnerabilities and threats

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.

CVE-2026-77128 is a medium severity vulnerability in the TYPO3 extension "Event management and registration." It involves missing authorization checks that allow an unauthenticated remote user to bypass enable-field restrictions and view hidden or time-restricted events by passing a demand-override parameter. This issue occurs unless the plugin setting disableOverrideDemand is enabled.

CVE-2026-77129 is a high-severity vulnerability in the TYPO3 extension "Event management and registration." It allows a backend user with edit access to supply malicious Fluid ViewHelper syntax in an email subject field, which is passed directly into a Fluid template without restriction. This can lead to disclosure of sensitive data or execution of TypoScript content objects. Exploitation requires authenticated backend access with edit permissions to the event plugin or backend module.

The TYPO3 extension "SYSSY - TYPO3 Monitoring & Security Checks" contains a vulnerability where it does not properly validate the expiration of client-supplied JWT tokens. This flaw allows an attacker who already possesses a valid API key to authenticate using an expired token. The vulnerability affects versions from 0 up to but not including 3.0.6. It has a medium severity rating with a CVSS score of 5.3.

The TYPO3 extension "SYSSY - TYPO3 Monitoring & Security Checks" transmits system information in cleartext when OpenSSL is unavailable on the server. This vulnerability requires the attacker to already have control of the SYSSY project's API key to exploit. It affects versions from 0 up to but not including 3.0.6. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.

A missing authorization vulnerability in the TYPO3 extension "femanager" allows logged-in users to escalate their privileges by assigning themselves to arbitrary frontend user groups when using the default profile edit plugin configuration. This affects multiple versions of the extension prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 6.0.

CVE-2026-77134 is a high-severity authorization vulnerability in the TYPO3 extension "femanager." The flaw allows a regular user to self-approve a pending account that requires admin approval by using a user confirmation hash obtainable through a public action, bypassing the intended admin confirmation token requirement.

CVE-2026-77135 is a high-severity authorization bypass vulnerability in the TYPO3 extension "femanager." It allows any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data by supplying an arbitrary user ID. The vulnerability arises because the extension's user detail view does not verify that the requested user record matches the configured or logged-in target. This can expose sensitive personal information such as name, email, date of birth, and address.

A critical vulnerability (CVE-2026-77136) exists in the TYPO3 extension "powermail" where an attacker can submit malicious Fluid template syntax via a form field configured as the sender's name. This input is rendered without sanitization, allowing arbitrary Fluid ViewHelpers execution. Exploitation requires no authentication and can disclose sensitive server information or potentially enable remote code execution. The vulnerability affects multiple versions of the extension and is actively exploited in the wild.

An SQL injection vulnerability exists in the TYPO3 Extension "Forms Export" due to improper sanitization of user input. A low-privileged backend user with read access to the "Forms Export" backend module can exploit this by injecting arbitrary SQL through a URL parameter. The vulnerability affects multiple versions of the extension and has a high severity rating.

A critical deserialization vulnerability exists in the TYPO3 extension "HTML5 Video Player vs. Powermail" (versions up to 0.2.1). The extension unsafely processes attacker-controlled cookie data using PHP's unserialize(), enabling remote unauthenticated attackers to trigger PHP Object Injection and potentially achieve remote code execution on the server.

CVE-2026-77139 is a path traversal vulnerability in the TYPO3 extension "Mask" that allows an authenticated backend user with access to the Mask module to create or delete .html files outside the intended template directory by supplying crafted template element keys. This occurs because the extension does not properly validate client-supplied keys before using them to build file paths. The vulnerability affects certain versions of the Mask extension prior to 9.0.11 and 8.3.12. The CVSS 4.0 score is 6.0, indicating a medium severity.

CVE-2026-77140 is a high-severity authorization vulnerability in the TYPO3 extension "Telephone Directory." The extension only validates the HMAC of a frontend employee edit link when rendering the edit form, but not when persisting changes. This allows an unauthenticated attacker who knows the UID of a visible employee record to send a direct POST request to update that record without proper authorization or ownership checks.

CVE-2026-77141 is a high-severity vulnerability in the TYPO3 extension "Club Directory" that allows unauthenticated users to modify or publish club records without ownership verification. The extension fails to perform ownership checks on user-supplied record identifiers in frontend edit, update, and activate actions. This enables attackers who know a club record's UID to overwrite or publish records they do not own.

CVE-2026-77142 is a high-severity vulnerability in the TYPO3 Extension "Industry Directory" that allows unauthorized modification of company records. The frontend editing feature hides the edit form for companies a visitor does not own using a template-level visibility flag, but the server-side write operation does not verify ownership. This flaw enables an attacker who knows a company record identifier to submit update requests and overwrite data without authorization checks.

CVE-2026-77143 is a high-severity vulnerability in the TYPO3 Extension "Forum" that allows unauthorized modification of forum topics. The issue arises because the frontend topic editing process does not verify on the server side whether the visitor owns the topic being edited. An attacker who knows a topic's public identifier can submit update requests to overwrite content without ownership confirmation. This flaw requires no privileged access or special configuration to exploit.

CVE-2026-77144 is a vulnerability in the TYPO3 Extension "Events 2" that allows a user with frontend event management access to create events attributed to organizers other than themselves. This occurs because the plugin assigns a new event to the submitting user's organizer record only if no organizer is specified in the request, and the permission check only verifies that the user has any organizer role, not that they own the organizer record. The vulnerability has a high severity with a CVSS score of 7.1.