CVE-2026-46721
Broken Access Control in extension "Frontend User Registration" (sf_register)
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 19, 2026
- Updated
- May 19, 2026
- Reserved
- May 16, 2026
Description
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | TYPO3 |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Extension "Frontend User Registration"TYPO3 |
|
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-009vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.