GitHub Advisoryadvisory · Packagist

GHSA-v348-vr4q-fv9p TYPO3 sf_register extension allows unauthorized assignment of frontend user groups

MEDIUM Published 2026-05-19 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-46721
Ecosystem
Packagist
Packages
evoweb/sf-register
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2026-06-29

Affected packages

• Packagist evoweb/sf-register: >= 14.0.0, < 14.0.2 → fixed in 14.0.2 • Packagist evoweb/sf-register: < 13.2.4 → fixed in 13.2.4

Description

The `create` and `edit` flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

Related

Alias · CVE (1)

  • CVE-2026-46721 The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References