CVE-2026-77127

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated, low-privileged backend user can exploit a backend AJAX endpoint used for inline editing that fails to restrict access to fields the user is not permitted to see or edit. By supplying arbitrary table, field, and record parameters, an attacker can trigger an error response that discloses the current database value of the requested field. This can lead to the exposure of sensitive information, including password hashes for both backend and frontend users. Exploitation requires a valid account with access to the extensions backend module.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.