Is CVE-2026-77127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77127 being exploited in the wild.

How severe is CVE-2026-77127?

Informational severity, with a CVSS score of 6.5, published 25 August 2026.

Which products and versions are affected?

Typo3 Modules extension 7.10.3 and below, 8.0.0 - 8.1.3.

Is there a fix for CVE-2026-77127?

A patch was published on 2026-08-25: Updated versions 7.10.4 and 8.1.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77127 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77127?

Check whether you run Typo3 Modules extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77127: TYPO3 Modules extension information disclosure in backend AJAX endpoint

CVE-2026-77127 · Severity: info · CVSS 6.5 · Published 2026-08-25

The TYPO3 "Modules" extension contains a backend AJAX endpoint for inline editing that fails to properly restrict access to database fields based on user permissions. A low-privilege authenticated backend user can exploit this to retrieve sensitive information such as password hashes from any field in any table through error messages, potentially compromising both backend and frontend user accounts.

Vendors: Typo3.

Quick answers

Is CVE-2026-77127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77127 being exploited in the wild.
How severe is CVE-2026-77127?: Informational severity, with a CVSS score of 6.5, published 25 August 2026.
Which products and versions are affected?: Typo3 Modules extension 7.10.3 and below, 8.0.0 - 8.1.3.
Is there a fix for CVE-2026-77127?: A patch was published on 2026-08-25: Updated versions 7.10.4 and 8.1.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77127 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77127?: Check whether you run Typo3 Modules extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the inline editing AJAX endpoint of the TYPO3 "Modules" extension. The endpoint fails to validate whether the authenticated user has permission to view or edit requested database fields, allowing a low-privileged backend user to supply arbitrary table, field, and record parameters. When an invalid field is requested, the endpoint returns an error response containing the actual database value, disclosing sensitive data including password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extension's backend module. Patched versions 7.10.4 and 8.1.4 are available.

Affected products

TYPO3 Modules extension 7.10.3 and below, 8.0.0 - 8.1.3

Timeline

2026-08-25: disclosed: TYPO3-EXT-SA-2026-016 published
2026-08-25: patched: Updated versions 7.10.4 and 8.1.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.