CVE-2026-120333 Details
Description
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
A broken access control vulnerability has been identified in the TYPO3 extension 'Frontend User Registration' (sf_register), affecting versions 13.2.4 and below, as well as 14.0.0 to 14.0.2. The vulnerability arises because the extension's email-linked actions, such as account registration confirmation or deletion, do not properly validate request hashes. This oversight allows unauthenticated attackers to impersonate any active frontend user, potentially accessing their email addresses or usernames and deleting their accounts.
Users are advised to update to version 13.2.5 or 14.0.3 of the 'Frontend User Registration' extension. The updated versions are available through the TYPO3 Extension Manager, Packagist, and from the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-038 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Frontend User Registration | <= 13.2.4 (semver) >= 14.0.0, <= 14.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | TYPO3 |