Executive brief
The "Industry Directory" extension for TYPO3 (a popular enterprise content management system) allows company records to be edited via a self-service frontend feature. The application only hides the edit form from non-owners on the client side but fails to verify ownership on the server side, allowing any attacker who discovers a company ID to modify or overwrite that company's data without authorization.
Technical details
This is a broken access control vulnerability (CWE-862, CWE-639) in the yellowpages2 TYPO3 extension. The vulnerable component is the frontend company self-service editing feature, which relies solely on a template-level visibility flag to prevent unauthorized access to the edit form. The application fails to repeat the ownership check on the server side before processing write operations. An unauthenticated attacker with network access can identify company record IDs from the public directory and submit direct update requests to modify or overwrite company data without any ownership verification. Patched versions 6.1.6, 7.0.3, and 8.1.2 are available.
Affected products
- JWeiland Industry Directory (yellowpages2) 6.1.5 and below, 7.0.0 - 7.0.2, 8.0.0 - 8.1.1
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Patched versions 6.1.6, 7.0.3, and 8.1.2 released