MEDIUM
GHSA-v348-vr4q-fv9p
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups
Details
The `create` and `edit` flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / evoweb/sf-register
Introduced in:
14.0.0 Fixed in: 14.0.2 Fix
composer require evoweb/sf-register:^14.0.2 Packagist / evoweb/sf-register
Introduced in:
0 Fixed in: 13.2.4 Fix
composer require evoweb/sf-register:^13.2.4