CVE-2026-77142: 
PHP vulnerability analysis and mitigation

CVE-2026-77142 is an authorization bypass vulnerability in the TYPO3 extension "Industry Directory" (jweiland/yellowpages2) that allows unauthenticated network attackers to overwrite company records in the public directory without ownership validation. The flaw was disclosed on August 25, 2026, and affects all versions of the extension prior to 8.1.2. It carries a CVSS v4.0 base score of 8.8 (High), assigned by TYPO3 (TYPO3 Advisory, GitHub Advisory).

The root cause is a missing server-side authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639). The frontend self-service editing feature uses a template-level visibility flag to hide the edit form from visitors who do not own a company record, but this check is purely client-side and is never repeated on the server when the write operation is processed. An attacker who can enumerate or guess a company record identifier from the publicly accessible directory can craft a direct HTTP update request targeting that record's ID, bypassing the UI restriction entirely and overwriting the record's data without any ownership confirmation (TYPO3 Advisory, GitHub Advisory).

Successful exploitation allows any unauthenticated network user to overwrite the data of any company record listed in the public directory, resulting in a high integrity impact on the vulnerable system. Attackers could corrupt, falsify, or deface company listings — including contact details, addresses, and other business information — for any organization in the directory. There is a low confidentiality impact as record identifiers and potentially other data may be inferred during exploitation, though availability is not affected (GitHub Advisory, TYPO3 Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker who can identify a valid company record ID from the public directory. The EPSS score is currently 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (TYPO3 Advisory).

1. Reconnaissance: Browse the public company directory on a TYPO3 site running jweiland/yellowpages2 prior to version 8.1.2 to enumerate company record identifiers (e.g., numeric IDs visible in URLs or page parameters).
2. Identify the update endpoint: Observe or infer the frontend self-service update endpoint used by the edit form (e.g., a form action URL or TYPO3 plugin action handler for company record updates).
3. Craft a direct update request: Construct an HTTP POST request targeting the write/update action, supplying the target company's record identifier and the desired replacement field values, bypassing the template-level visibility restriction entirely.
4. Submit the request: Send the crafted request directly to the server without being authenticated as the record owner. The server processes the write operation without performing an ownership check, overwriting the target company's data with the attacker-supplied values (TYPO3 Advisory, GitHub Advisory).

• Network: Unexpected HTTP POST requests to the TYPO3 frontend plugin update/save action for company records, originating from IP addresses not associated with the legitimate company owner; repeated requests cycling through sequential or enumerated company record IDs.
• Logs: TYPO3 access logs showing POST requests to the company self-service edit action from unauthenticated or unrecognized sessions; multiple update operations on different company records from the same source IP in a short timeframe.
• Application Data: Unexplained or unauthorized changes to company record fields (name, address, contact details, etc.) in the Industry Directory that do not correspond to legitimate owner activity.

Upgrade the jweiland/yellowpages2 TYPO3 extension to version 8.1.2 or later, which introduces server-side ownership validation on write operations (TYPO3 Advisory). As a temporary workaround prior to patching, administrators should implement server-side authorization checks that validate user ownership before processing any company record update, or disable the frontend self-service editing feature entirely until the patch is applied. Additionally, consider restricting access to the public directory or applying rate limiting on update requests to reduce exposure.