TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register)

• Release Date:  November 3, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "Frontend User Registration" (sf_register)
• Composer Package Name: evoweb/sf-register
• Vulnerability Type: Broken Access Control
• Affected Versions: 13.2.4 and below, 14.0.0 - 14.0.2
• Severity: High
• Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
• References: CVE-2026-120333, CWE-639

Problem Description

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

Solution

Updated versions 13.2.5 and 14.0.3 are available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/sf_register/13.2.5/zip 
https://extensions.typo3.org/extension/download/sf_register/14.0.3/zip 

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Tobias Gülzow for reporting the vulnerability and to Sebastian Fischer for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.