The vulnerability lies in the frontend self‑service editing feature of the Industry Directory extension, which uses a template‑level flag to hide the edit form for company records that a visitor does not own. This is an example of CWE‑639 (authorization bypass) combined with a missing ownership check that violates CWE‑862. However, the corresponding server‑side write operation does not re‑apply an ownership check. Consequently, any visitor who knows the identifier of a company record—available from the public directory—can submit a modified update request directly to the server and overwrite that record’s data without the application verifying ownership. This permits arbitrary, unauthorized changes to company information, potentially undermining trust and enabling further attacks such as phishing or data manipulation.

TYPO3 installations running the Industry Directory extension (yellowpages2). No specific affected version range is supplied, so the risk applies to any instance of the extension regardless of the TYPO3 core version.

The CVSS score of 8.8 signals a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the attack can be launched over the network by simply knowing the record identifier, which can be discovered from the public directory. The lack of server‑side ownership verification means the exploit will succeed without authentication, giving the attacker full control to overwrite company data. This high‑impact, low‑barrier exploit path warrants immediate attention.