CVE-2026-77131: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

Published Aug 25, 2026

Updated

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Affected Software

1 affected component

SYSSY SYSSY - TYPO3 Monitoring & Security Checks

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already control the SYSSY project's API key. The issue is network-reachable, but it does not require user interaction.

When is the affected cleartext transmission triggered?

It occurs when OpenSSL is unavailable on the server. In that condition, the extension sends TYPO3 system information without encryption.

What information could be exposed or altered?

The stated impacts are limited to confidentiality and integrity of TYPO3 system information. No availability impact is identified.

CVE-2026-77131: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

When is the affected cleartext transmission triggered?

What information could be exposed or altered?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When is the affected cleartext transmission triggered?

What information could be exposed or altered?