CVE-2026-46721: TYPO3 Extension Frontend User Registration

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

Affected products

• TYPO3 Extension Frontend User Registration: from 14.0.0, before 14.0.2 (fixed in 14.0.2); before 13.2.4 (fixed in 13.2.4)

Published 2026-05-19. Last modified 2026-06-17.