PT-2026-81241
CVE-2026-77141
·
تاريخ النشر
2026-08-25
·
تاريخ التحديث
2026-09-28
الوصف من
CVSS 4.0
8.8
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Club Directory (affected versions not specified)
Description
Broken access control exists in the frontend edit, update, and activate actions. The extension resolves the targeted club record from a user-supplied request argument but fails to perform an ownership check. Consequently, an unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action to overwrite the record or publish one that is awaiting approval without owning it.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾