CVE-2026-46721: Broken Access Control in extension "Frontend User Registration" (sf_register)
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46721?
CVE-2026-46721 is classified as a high severity vulnerability due to its potential for unauthorized access and manipulation of user groups.
How do I fix CVE-2026-46721?
To fix CVE-2026-46721, ensure that proper access controls are enforced on the create and edit flows of the Frontend User Registration extension.
What impact does CVE-2026-46721 have on users?
CVE-2026-46721 can allow attackers to assign arbitrary frontend user groups, potentially leading to privilege escalation and unauthorized access.
Which software versions are affected by CVE-2026-46721?
CVE-2026-46721 affects the TYPO3 Frontend User Registration extension, specifically versions that lack the necessary access control mechanisms.
Is there a workaround for CVE-2026-46721?
Currently, the recommended workaround for CVE-2026-46721 is to manually review and restrict user role assignments until an update can be applied.