CVE-2026-120333
Received Received - Intake

Unauthenticated Account Deletion in Browser Extension

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: TYPO3

Description
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120333
EUVD
EUVD-2026-115736

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "Frontend User Registration" 14.0.0
TYPO3 Extension "Frontend User Registration" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in the TYPO3 extension 'Frontend User Registration'. Unauthenticated attackers can manipulate email links by removing or altering the hash parameter. The system then processes these requests without proper validation, allowing attackers to perform actions like confirming registrations or deleting accounts for any active frontend user. This exposes user data and enables account deletion without authorization.

Detection Guidance

Check if the TYPO3 extension 'Frontend User Registration' (sf_register) is installed and if its version is 13.2.4 or below, or 14.0.0 to 14.0.2. Review email links in the extension for missing or invalid hashes in registration or deletion actions.

Impact Analysis

If you use the vulnerable extension, attackers could delete any frontend user account, including yours, without authentication. They could also retrieve email addresses or usernames of all users by exploiting the missing hash validation in email links. This compromises user privacy and account security.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data (email addresses, usernames) and potential data deletion without consent. It may also conflict with HIPAA if user accounts contain protected health information. Organizations using this extension must address it to maintain compliance.

Mitigation Strategies

Update the 'Frontend User Registration' extension to version 13.2.5 or 14.0.3 immediately. Disable or restrict access to the vulnerable actions until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...