CVE-2026-77141: Broken Access Control in extension "Club Directory" (clubdirectory)
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the extension's frontend edit, update, and activate actions, add an ownership/authorization check to verify the requesting user owns (or is authorized to modify) the targeted club record resolved from the user-supplied request argument. Deny the action when the requester does not own the record, including for records still awaiting approval.
Extension "Club Directory" (clubdirectory) Ownership/authorization check for edit, update, and activate actions = Enforce ownership verification before allowing update/activate and approval-state changes