Broken Access Control in extension "Frontend User Registration" (sf_register)
Affects the third-party sf_register extension (Frontend User Registration) at 13.2.4 and below and 14.0.0 through 14.0.2, not part of the TYPO3 default installation. Fixed in 13.2.5 and 14.0.3.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 14.0.3, 13.2.5
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 14.0.3, 13.2.5.
- Exploitation0/40No signal
- Exposure20/25No login or user action needed, CISA rates it automatable · Data gap: Advisories don't say whether default setups are affected
- Reach10/20Affects Packagist packages
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 84 if added to CISA KEV
- Would score about 79 if CISA's SSVC rates exploitation active
- Would score about 44 if advisories confirm default setups are exposed
CVE-2026-120333 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Extension "Frontend User Registration"; fixed in 14.0.3 and 13.2.5.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.42% · 36th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 39/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 14.0.3, 13.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The "Frontend User Registration" extension (sf_register) for TYPO3 is affected. Unauthenticated attackers can exploit missing hash checks on email-linked actions to view the email addresses and usernames of frontend users and delete arbitrary user accounts.
Read the original description
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
What to do
Upgrade to a fixed version: 14.0.3, 13.2.5.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- evoweb/sf-registerPackagist
From 14.0.0 · fixed in 14.0.3; fixed in 13.2.5
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120333
Is CVE-2026-120333 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The flaw lets an unauthenticated visitor perform email-linked actions for any active frontend user. These actions can reveal a user's email address or username, or delete that user's account.Source: news.typo3.com
Which versions are affected by CVE-2026-120333?
evoweb/sf-register (Packagist): from 14.0.0 before 14.0.3; before 13.2.5.Source: cve.now feed data
Am I affected, and how do I check?
sf_register versions 13.2.4 and below, and 14.0.0 through 14.0.2, are affected. It is a third-party extension and not part of the TYPO3 default installation, so first check whether it is installed and which version the extension manager lists for it.Source: news.typo3.com
How do I fix CVE-2026-120333?
Update sf_register to 13.2.5, or to 14.0.3 on the 14.0 line. The fixed versions are available from the TYPO3 extension manager and Packagist.Source: news.typo3.com