CVE-2026-77140

HighCVSS 8.7/10Last modified Sep 28, 2026

Description

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771418.8The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, bu CVE-2026-771428.8The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a vis CVE-2026-771438.8The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a CVE-2026-771447.1The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no CVE-2026-771457.1The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user w CVE-2026-771468.3The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or CVE-2026-771476.5Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for CVE-2026-771489.9A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&secti CVE-2026-77156.3A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7. This affects the function arango_backup of the file src/tools.t CVE-2026-771506.1The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all CVE-2026-771513.7A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/uti CVE-2026-771566.4Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal