TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory)
It has been discovered that the extension "Telephone Directory" (telephonedirectory) is susceptible to Broken Access Control.
- Release Date: August 25, 2026
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Telephone Directory" (telephonedirectory)
- Composer Package Name: jweiland/telephonedirectory
- Vulnerability Type: Broken Access Control
- Affected Versions: 6.1.2 and below
- Severity: High
- Suggested CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- References: CVE-2026-77140, CWE-862, CWE-639
Problem Description
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
Solution
Updated version 6.2.0 is available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/telephonedirectory/6.2.0/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to Seungbin Yang for reporting the vulnerability, and to Hoja Mustaffa Abdul Latheef for providing an updated version of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide.
