Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120333— Broken Access Control in extension "Frontend User Registration" (sf_register)

Quick assessment

Affected
TYPO3 Extension "Frontend User Registration"
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该扩展在电子邮件中提供的操作链接（例如用于确认注册或删除账户）未拒绝缺少或无效的哈希值请求，而是直接使用请求中指定的前端用户。因此，未认证的攻击者可以对任意活跃的前端用户执行这些操作，从而获取所有前端用户的电子邮件地址或用户名，并删除任意前端用户的账户。

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120333

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Broken Access Control in extension "Frontend User Registration" (sf_register)
Source: CVE Program / CVE List V5
Vulnerability Description
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TYPO3 Extension "Frontend User Registration" 14.0.0 ~ 14.0.3 -

II. Public POCs for CVE-2026-120333

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120333

请登录查看更多情报信息。

Other References for CVE-2026-120333 (1)

Same Patch Batch · TYPO3 · 2026-11-03 · 7 CVEs total

CVE-2026-120330 7.1 HIGH Broken Access Control in extension "Mail" (mail)
CVE-2026-120328 6.9 MEDIUM Information Disclosure in extension "Mail" (mail)
CVE-2026-120327 5.3 MEDIUM Open Redirection in extension "Mail" (mail)
CVE-2026-120329 5.3 MEDIUM Broken Access Control in extension "Mail" (mail)
CVE-2026-120331 5.3 MEDIUM Server-Side Request Forgery in extension "Mail" (mail)
CVE-2026-120332 5.1 MEDIUM Cross-Site Scripting in extension "Mail" (mail)

IV. Related Vulnerabilities

Same product: Extension "Frontend User Registration"
Same vendor: TYPO3
Same weakness: CWE-639