CVE-2026-77143

Broken Access Control in extension "Forum" (pforum)

State: Published
Severity: 8.8 High
Published: Aug 25, 2026
Updated: Aug 26, 2026
Reserved: Aug 20, 2026

Description

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-862 Missing Authorization
CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Extension "Forum"TYPO3	6.0.0 to before 6.2.4Affected 5.0.0 to before 5.0.1Affected before 4.0.4Affected

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-021vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.