Typo3 Extension "Frontend User Registration" vulnerabilities
2 vulnerabilities
Known vulnerabilities in Typo3 Extension "Frontend User Registration", newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-120333typo3 · extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.CVSS8.8HighEPSS0.42%RoutineCVE-2026-46721typo3 · extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.CVSS6.9MediumEPSS0.36%