CVE-2026-77133

MediumCVSS 6.0/10Last modified Aug 26, 2026

Description

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771348.3The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmat CVE-2026-771358.2The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visit CVE-2026-771369.5The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as CVE-2026-771377.7The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inje CVE-2026-771389.3The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, una CVE-2026-771396.0The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask temp CVE-2026-77146.5A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file CVE-2026-771408.7The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that pers CVE-2026-771418.8The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, bu CVE-2026-771428.8The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a vis CVE-2026-771438.8The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a CVE-2026-771447.1The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no