CVE-2026-120333: TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register)
Published Nov 3, 2026
·Updated
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
Other sources
TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sfregister)
— Packagist
Affected Software
2 affected componentsFixes available
composer/evoweb/sf-register>=14.0.0, <14.0.3
14.0.3
composer/evoweb/sf-register<13.2.5
13.2.5
Event History
Nov 3, 2026
Advisory Published
via Packagist·09:00 AM
Data Sourced
via Packagist·09:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·09:56 AM
Data Sourced
via MITRE·09:56 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness