GHSA-v348-vr4q-fv9p

Suggest an improvement
Source
https://github.com/advisories/GHSA-v348-vr4q-fv9p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-v348-vr4q-fv9p/GHSA-v348-vr4q-fv9p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v348-vr4q-fv9p
Aliases
Published
2026-05-19T12:31:39Z
Modified
2026-09-10T03:50:47Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Details

The create and edit flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

Database specific 
{
    "cwe_ids":  [
        "CWE-639"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-29T22:58:05Z",
    "nvd_published_at":  "2026-05-19T10:16:24Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / evoweb/sf-register

Package

Name
evoweb/sf-register
Purl
pkg:composer/evoweb/sf-register

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14.0.0
Fixed
14.0.2

Affected versions

14.*
14.0.0
14.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-v348-vr4q-fv9p/GHSA-v348-vr4q-fv9p.json"

Packagist / evoweb/sf-register

Package

Name
evoweb/sf-register
Purl
pkg:composer/evoweb/sf-register

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
13.2.4

Affected versions

6.*
6.2.9
8.*
8.7.0
8.7.1
8.7.2
8.7.3
8.8.0
8.8.1
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
9.*
9.0.0
9.1.0
9.2.0
9.3.0
9.4.0
9.4.1
10.*
10.0.0
10.0.1
10.0.2
10.1.0
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.1.6
10.1.7
10.2.0
11.*
11.0.0
11.1.0
11.1.1
11.1.2
11.1.3
11.1.4
11.1.5
12.*
12.0.0
12.0.1
13.*
13.0.0
13.0.1
13.1.0
13.1.1
13.1.2
13.1.3
13.1.4
13.2.0
13.2.1
13.2.2
13.2.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-v348-vr4q-fv9p/GHSA-v348-vr4q-fv9p.json"