CVE-2026-77140

Name of the Vulnerable Software and Affected Versions Telephone Directory (affected versions not specified)

Description Broken access control exists in the extension where the HMAC (Hash-based Message Authentication Code, a mechanism for verifying data integrity and authenticity) of a frontend employee edit link is validated only when rendering the edit form, but not when persisting the changes. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action to overwrite that record without a valid edit link or ownership verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.