TYPO3 Frontend User Registration extension lets attackers read member emails and delete accounts
A website sign-up add-on can leak member emails and let attackers delete accounts.
Summary
Links in the sf_register extension's confirmation and account deletion emails do not check the request's hash, so unauthenticated attackers can read frontend users' email addresses or usernames and delete their accounts. Versions 13.2.4 and below and 14.0.0 to 14.0.2 are affected.
What to do
Update to 13.2.5 or 14.0.3 from the TYPO3 extension manager, Packagist, or the official download page.
Update to at least the version for your product:
- TYPO3 sf_register 13.2 13.2.5 or later
- TYPO3 sf_register 14.0 14.0.3 or later
Products and platforms
CVE IDs
Sources
- Advisory: typo3.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen