Medium severity · published May 19, 2026
CVE-2026-46721
Broken Access Control in extension "Frontend User Registration" (sf_register)
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Extension "Frontend User Registration" · TYPO3
14.0.0 before 14.0.2; before 13.2.4 · source: vendor
Affected product
EF
Extension "Frontend User Registration"
TYPO3