CVE-2026-77134

Vulnerability Description

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

Related Weaknesses (CWE)

CWE-863

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-024

FAQ

What is CVE-2026-77134?

CVE-2026-77134 is a documented vulnerability. The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resen...

How severe is CVE-2026-77134?

CVSS scoring is not yet available for CVE-2026-77134. Check NVD for updates.

Is there a patch for CVE-2026-77134?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.