The vulnerability is found in the TYPO3 extension "Frontend User Registration" (sf_register). In the create and edit flows, the extension does not enforce restrictions on which user properties can be set, leaving the frontend user group assignment unchecked. As a result, an attacker can submit requests that assign any arbitrary frontend user group to a newly registered or edited account, giving that account access to content and features normally limited to more privileged groups. This bypasses the intended access control and allows unauthorized access to restricted resources.

Affected systems are installations of the TYPO3 "Frontend User Registration" extension, also known as sf_register. No specific version information is provided, so the risk applies to any version of the extension until a patch is applied.

The CVSS score of 6.9 indicates moderate severity, but the vulnerability can be exploited remotely by submitting crafted HTTP requests via the public registration or edit forms. No exploit probability score is available and it is not listed in the CISA KEV catalog. The attack requires only the ability to send registration or edit requests with arbitrary group identifiers and does not need prior authentication, making exploitation feasible for anyone with internet access to the site.