A server-side authorization bypass in the TYPO3 Industry Directory extension allows unauthorized users to modify company records due to insufficient ownership validation.

The extension suffers from CWE-862 and CWE-639, where the server-side write operation fails to verify ownership of a company record. The application incorrectly relies on template-level visibility to prevent unauthorized editing, which is easily bypassed.

The CVSS score of 8.8 indicates high severity. If exploited, an attacker could change company information, potentially leading to unauthorized data modification, fraudulent listings, or the dissemination of incorrect information, which significantly impacts the reliability and integrity of the directory.

Immediate Action: Update the Industry Directory extension to version 8.1.2 or later to ensure proper server-side ownership checks are enforced.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting the company self-service editing feature.

Compensating Controls: Implement strict access control lists or WAF rules to validate the legitimacy of edit requests if immediate patching cannot be performed.

Public Exploit Available: No confirmed public exploit in the available data.

This vulnerability represents a significant security oversight. Organizations must apply the vendor-provided patch to version 8.1.2 immediately to prevent unauthorized modification of directory data by unauthenticated users.