The Telephone Directory extension validates the HMAC only during form rendering, but the action that commits changes omits this check. An unauthenticated user who knows the unique identifier of any visible employee record can craft a direct POST request to the update endpoint and overwrite that record's data without a valid edit link or any ownership verification. This flaw permits unauthorized data modification and effectively elevates the attacker’s privileges to that of the record owner.

TYPO3 installations that include the Telephone Directory extension are affected. No version confinement is listed, so any instance of the extension that has not yet been updated to incorporate HMAC validation in its persistence routine remains vulnerable.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available, so exact exploitation probability cannot be quantified, and the lack of a KEV listing does not lessen the potential impact. The likely attack vector is a direct web request; an attacker only needs to know an employee UID and craft a POST request to the update endpoint. If the endpoint is reachable from the public Internet, the attack can be automated with modest effort, making it a practical threat to affected sites.