Executive brief
The TYPO3 Telephone Directory extension allows unauthenticated users to modify employee records by bypassing authorization checks. An attacker who knows an employee's ID can directly submit a modification request without a valid edit link, allowing them to alter or corrupt employee directory data without proper permission.
Technical details
The vulnerability is a broken access control issue (CWE-862, CWE-639) in the Telephone Directory extension. The HMAC validation of frontend employee edit links is performed only in the action that renders the edit form, but not in the action that persists changes to the database. An unauthenticated attacker with knowledge of an employee record's UID can craft a direct POST request to the update action to overwrite employee data without providing a valid edit link or passing any ownership validation. No authentication or user interaction is required. Fixed versions 4.1.1, 5.0.1, and 6.2.0 are available.
Affected products
- JWeiland.net Telephone Directory 4.1.0 and below, 5.0.0, 6.0.0–6.1.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 4.1.1, 5.0.1, and 6.2.0