CVE-2026-77141 — Broken Access Control in extension "Club Directory" (clubdirectory)
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any …
Published: 2026-08-25 · CVSS: 8.8 · CVSS 4.0
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7