CVE-2026-77141 in Club Directory Extension
Resumen
por MITRE • 2026-08-25
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.