Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Summary
| CVE | CVE-2026-112240 |
|---|---|
| State | PUBLISHED |
| Assigner | TYPO3 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-20 10:17:04 UTC |
| Updated | 2026-10-20 19:28:52 UTC |
| Description | The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email. |
Risk And Classification
Primary CVSS: v4.0 6.3 MEDIUM from f4fb688c-4412-4426-b4b8-421ecf27b14a
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-338 | CWE-639 | CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key | CWE-338 CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | f4fb688c-4412-4426-b4b8-421ecf27b14a | Secondary | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
LowIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | TYPO3 | Extension TYPO3 Fluid-Form By Coding.ms | affected 6.0.0 6.0.6 semver | Not specified |
| CNA | TYPO3 | Extension TYPO3 Fluid-Form By Coding.ms | affected 5.0.10 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| typo3.org/security/advisory/typo3-ext-sa-2026-033 | f4fb688c-4412-4426-b4b8-421ecf27b14a | typo3.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Thomas Deuling (en)
CNA: Thomas Deuling (en)
There are currently no legacy QID mappings associated with this CVE.