CVE-2026-46721: TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Other sources
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sfregister)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/evoweb/sf-registerto a version that resolves this vulnerability.Fixed in 14.0.2 - Upgrade
Upgrade
composer/evoweb/sf-registerto a version that resolves this vulnerability.Fixed in 13.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46721?
CVE-2026-46721 is classified as a high severity vulnerability due to its potential for unauthorized access and manipulation of user groups.
How do I fix CVE-2026-46721?
To fix CVE-2026-46721, ensure that proper access controls are enforced on the create and edit flows of the Frontend User Registration extension.
What impact does CVE-2026-46721 have on users?
CVE-2026-46721 can allow attackers to assign arbitrary frontend user groups, potentially leading to privilege escalation and unauthorized access.
Which software versions are affected by CVE-2026-46721?
CVE-2026-46721 affects the TYPO3 Frontend User Registration extension, specifically versions that lack the necessary access control mechanisms.
Is there a workaround for CVE-2026-46721?
Currently, the recommended workaround for CVE-2026-46721 is to manually review and restrict user role assignments until an update can be applied.