A critical authorization vulnerability in the TYPO3 Direct Mail extension allows authenticated attackers to execute arbitrary code or inject malicious configurations.

This vulnerability, categorized as CWE-863, stems from improper authorization checks within the Configuration backend module. An attacker with a valid backend user account and access to the Direct Mail module can modify arbitrary TSConfig pages, leading to configuration injection or remote code execution depending on the TYPO3 version.

The ability for an authenticated user to achieve arbitrary code execution poses a severe risk to the integrity and confidentiality of the entire TYPO3 environment. Given the CVSS score of 8.8, this flaw is considered high severity as it permits lateral movement and full system compromise by a malicious or compromised internal user account.

Immediate Action: Update the Direct Mail extension to versions 6.0.3, 7.0.3, or 9.5.2 to remediate the authorization flaw.

Proactive Monitoring: Review backend user logs and audit access permissions for the Direct Mail Configuration module to identify unauthorized modifications.

Compensating Controls: Implement strict access control lists for backend users and restrict access to the Direct Mail configuration module to only essential administrative personnel.

Public Exploit Available: No

Organizations utilizing the TYPO3 Direct Mail extension must prioritize applying the provided security updates to versions 6.0.3, 7.0.3, or 9.5.2. Because this vulnerability facilitates code execution, failing to patch allows any compromised low-privilege backend account to escalate their control over the web server, making immediate remediation essential to maintaining a secure posture.