---
id: CVE-2026-77143
title: >-
  The frontend topic editing flow does not verify on the server side that the
  requesting visitor owns the topic being modified
summary: >-
  The frontend topic editing flow does not verify on the server side that the
  requesting visitor owns the topic being modified. As a result, a visitor who
  knows the identifier of a topic from the public forum can submit a modified
  update r…
severity: none
cwe:
  - CWE-639
  - CWE-862
published: '2026-08-25'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T23:10:00.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77143'
references:
  - url: 'https://typo3.org/security/advisory/typo3-ext-sa-2026-021'
    label: f4fb688c-4412-4426-b4b8-421ecf27b14a
tags:
  - nvd
ingestedAt: '2026-09-28T23:23:00.543Z'
---

## Overview

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.