CVE-2026-77131

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771325.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe CVE-2026-771336.0The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses CVE-2026-771348.3The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmat CVE-2026-771358.2The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visit CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as CVE-2026-771377.7The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inje CVE-2026-771389.3The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, una CVE-2026-771396.0The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask temp CVE-2026-77146.5A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file CVE-2026-771408.7The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that pers CVE-2026-771418.8The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, bu CVE-2026-771428.8The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a vis