CVE-2026-77135Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://typo3.org/security/advisory/typo3-ext-sa-2026-024

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud45d
General
🚨*CVE* CVE-2026-77135 The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Deta… https://www.cve.org/CVERecord?id=CVE-2026-77135 ----- Traducción: CVE-2026-77135 La … https://infoflow.cloud`
Post summary
The tweet advertises CVE‑2026‑77135, noting a flaw where an extension’s user detail view does not verify the requested record against the logged‑in target, but it does not provide PoC, exploitation tools, patches, or evidence of active exploitation.
0000033
102 followersView on X
CVE@CVEnew45d
Disclosure
CVE-2026-77135 The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Deta… https://www.cve.org/CVERecord?id=CVE-2026-77135
Post summary
The post announces a flaw in an extension’s user‑detail view that omits verification of the requested record, enabling visitors to view any user’s data, and simply links to the CVE record.
00000808
58.0K followersView on X

Explore more

Back to dashboard