GHSA-v348-vr4q-fv9p
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | evoweb/sf-register | >= 14.0.0, < 14.0.2 | 14.0.2 |
| Packagist | evoweb/sf-register | < 13.2.4 | 13.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The `create` and `edit` flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
References
External links from the advisory. They lead to third-party sites.