TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)

• Release Date: August 25, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "Forum" (pforum)
• Composer Package Name: jweiland/pforum
• Vulnerability Type: Broken Access Control
• Affected Versions: 6.2.3 and below
• Severity: High
• Suggested CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
• References: CVE-2026-77143, CWE-862, CWE-639

Problem Description

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership.

Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.

Solution

Updated version 6.2.4 is available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/pforum/6.2.4/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Seungbin Yang for reporting the vulnerability, and to Hoja Mustaffa Abdul Latheef for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.