High severity · published Aug 25, 2026
CVE-2026-77140
Broken Access Control in extension "Telephone Directory" (telephonedirectory)
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Extension "Telephone Directory" · TYPO3
6.0.0 before 6.2.0; 5.0.0 before 5.0.1; before 4.1.1 · source: vendor