An authorization bypass vulnerability in the TYPO3 Club Directory extension allows unauthenticated attackers to modify club records without proper ownership validation.

The extension is susceptible to CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). It fails to verify if a user owns the club record they are attempting to edit, update, or activate via frontend actions.

With a CVSS score of 8.8, this vulnerability poses a high risk to data integrity. An attacker could modify club directory information, leading to unauthorized content changes, reputational damage, and the potential for malicious redirection or data corruption within the TYPO3 ecosystem.

Immediate Action: Update the Club Directory extension to version 8.1.3 or higher to apply the required ownership validation logic.

Proactive Monitoring: Monitor access logs for anomalous requests targeting the extension's edit or update actions, particularly those originating from unauthorized sources.

Compensating Controls: Utilize a Web Application Firewall to filter requests that manipulate record IDs in URL parameters if immediate patching is not feasible.

Public Exploit Available: No confirmed public exploit in the available data.

Administrators should treat this as a high-priority update. Because the vulnerability is automatable and requires no authentication, the risk of automated exploitation is elevated, necessitating an immediate upgrade to the patched version.