Executive brief
The "Club Directory" extension for TYPO3 (a popular content management system) fails to verify user ownership when editing, updating, or activating club records. An attacker who knows a club's identifier can directly modify or publish any club record without authentication, potentially allowing them to hijack club information, publish unauthorized entries, or disrupt legitimate club directory operations.
Technical details
The vulnerability is a broken access control (CWE-862, CWE-639) in the TYPO3 "Club Directory" extension's frontend actions for edit, update, and activate operations. The extension resolves club records from user-supplied request arguments but performs no ownership validation before allowing modifications. An unauthenticated attacker who knows the UID of a club record can send a direct HTTP request to the update or activate action to overwrite or publish that record without authorization. No prior authentication or user interaction is required. Updated versions 6.0.2, 7.0.2, and 8.1.3 have been released to address this issue.
Affected products
- JWeiland Club Directory 6.0.1 and below, 7.0.0–7.0.1, 8.0.0–8.1.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 6.0.2, 7.0.2, and 8.1.3