An authorization bypass in the TYPO3 Telephone Directory extension allows unauthenticated attackers to modify employee data by circumventing HMAC validation.

The extension performs a capability check only when rendering the edit form, but fails to re-validate the request during the persistence action, resulting in an authorization bypass.

This vulnerability allows unauthorized users to modify sensitive employee information, potentially leading to data corruption or the manipulation of directory contents. With a CVSS score of 8.7, this flaw poses a high risk to data integrity within the TYPO3 environment.

Immediate Action: Update the TYPO3 Telephone Directory extension to version 6.2.0 or later to ensure proper HMAC validation is enforced across all actions.

Proactive Monitoring: Review audit logs for unauthorized changes to employee directory entries or suspicious requests targeting the persistence action of the extension.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter suspicious traffic and block requests that attempt to access the persistence endpoint without a valid session.

Public Exploit Available: Unknown

The vulnerability represents a critical integrity risk to organizational data. Administrators must apply the update to version 6.2.0 immediately to prevent unauthorized modification of directory records.