Executive brief
The TYPO3 Forum extension (pforum) is a plugin that enables discussion forums within TYPO3-based websites. The extension fails to verify that a user owns a topic before allowing edits, allowing any visitor to overwrite the content of any public forum topic by submitting a direct update request with the topic's identifier. This could result in vandalism, misinformation, or reputational damage to forum discussions.
Technical details
The vulnerability is a broken access control flaw (CWE-862, CWE-639) in the frontend topic editing workflow. The application does not perform server-side authorization checks to confirm the requesting visitor is the owner of the topic being modified. An attacker with knowledge of a topic identifier (readily available from public forum listings) can submit a modified update request without authentication or special privileges, allowing arbitrary overwrite of topic content. The attack requires only network access and knowledge of a public topic ID. Patches are available in versions 4.0.4, 5.0.1, and 6.2.4.
Affected products
- JWeiland.net pforum 4.0.3 and below, 5.0.0, 6.0.0-6.2.3
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Updated versions 4.0.4, 5.0.1, and 6.2.4 released