CVE-2026-77140: Broken Access Control in extension "Telephone Directory" (telephonedirectory)
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it if they know the UID of an employee record that is visible. No valid frontend edit link, HMAC, or ownership of the record is required for the update request.
What must an attacker send to modify a record?
The attacker must send a direct POST request to the update action and supply the UID of a visible employee record. The vulnerable update action does not validate the HMAC that is checked when rendering the edit form.
What is the practical impact?
An attacker can overwrite a visible employee record. The provided CVSS vector indicates integrity impact is high, while confidentiality and availability impacts are not identified.