The vulnerability arises from missing ownership validation in the frontend edit, update, and activate actions of the Club Directory extension. An unauthenticated user who knows the unique identifier of a club record can send a crafted request to the update or activate endpoints, thereby overwriting the record’s contents or publishing a record that is still awaiting approval. This enables an attacker to modify club information or release content without authorization, effectively granting unauthorized privileged access to the data managed by the extension.

TYPO3 Extension "Club Directory" (ClubDirectory). No specific affected version information is provided, so all installed instances of this extension could be vulnerable until a fix is deployed.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available, but the lack of authentication and ownership checks means the attack can be performed by anyone who can guess or enumerate a record UID. The vulnerability is not listed in CISA KEV, but its nature allows for quick exploitation with minimal effort once a record identifier is known.