CVE-2026-77141: Broken Access Control in extension "Club Directory" (clubdirectory)
Vulnerability summary
CVE-2026-77141 is a high (CVSS 8.8) vulnerability in typo3 extension "club directory". EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.
Severe, CVSS 8.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 25-08-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.41% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Typo31 product
- extension "club directory"≥ 8.0.0, < 8.1.3 | ≥ 7.0.0, < 7.0.2 | < 6.0.2
1 vendor · 1 product
References
1 links- typo3.org/security/advisory/typo3-ext-sa-2026-019Vendor Advisory