CVE-2026-120333
Broken Access Control in extension "Frontend User Registration" (sf_register)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
| CWE | CWE-639 |
| Vendor | typo3 |
| Product | extension "frontend user registration" |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for typo3 extension "frontend user registration"
Be the first to know when new unknown vulnerabilities affecting typo3 extension "frontend user registration" are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TYPO3 / Extension "Frontend User Registration"
14.0.0 < 14.0.3 0 < 13.2.5
References
Credits
🔍 Tobias Gülzow Sebastian Fischer