The Forum extension fails to verify that a visitor owns the topic they wish to edit; a user can supply the topic identifier in a request and replace the original content. This flaw allows an unauthenticated visitor to rewrite any topic in the public forum. The lack of server‑side ownership checks means the application accepts the update without confirming the submitter’s authority, resulting in a direct integrity compromise.

TYPO3 Extension "Forum" (pforum). The vulnerability applies to any deployment of the extension where topic identifiers are publicly exposed and the editing endpoint is reachable. No specific version information is provided; the issue exists as long as the current codebase remains unchanged.

With a CVSS score of 8.8, the exploit has high impact. The attacker need only know a topic’s identifier, which is visible in the forum listing, and does not require privileged access or special configuration. The attack vector is an HTTP request to the editing endpoint; it relies on server‑side logic that omits ownership validation. Because no exploitation steps are constrained by authentication, any public user can alter content, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog.