CVE-2026-46721 — Broken Access Control in extension "Frontend User Registration" (sf_register)
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacke…
Published: 2026-05-19 · CVSS: 6.9 · CVSS 4.0
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7