p PatchFirst

CVE-2026-46721

CVE-2026-46721 · Broken Access Control in extension "Frontend User Registration" (sf_register)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • extension "frontend user registration"

    Versions
    • ≥ 14.0.0, < 14.0.2: Affected (semver)
    • ≥ 0, < 13.2.4: Affected (semver)

    Update to 13.2.4; Update to 14.0.2

  • evoweb/sf-register Packagist

    Versions
    • 14.0.0
    • 14.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 14.0.2

    Update to 14.0.2

  • evoweb/sf-register Packagist

    Versions
    • 10.0.0
    • 10.0.1
    • 10.0.2
    • 10.1.0
    • 10.1.1
    • 10.1.2
    • 10.1.3
    • 10.1.4
    • 10.1.5
    • 10.1.6
    • 10.1.7
    • 10.2.0
    • 11.0.0
    • 11.1.0
    • 11.1.1
    • 11.1.2
    • 11.1.3
    • 11.1.4
    • 11.1.5
    • 12.0.0
    • 12.0.1
    • 13.0.0
    • 13.0.1
    • 13.1.0
    • 13.1.1
    • 13.1.2
    • 13.1.3
    • 13.1.4
    • 13.2.0
    • 13.2.1
    • 13.2.2
    • 13.2.3
    • 6.2.9
    • 8.7.0
    • 8.7.1
    • 8.7.2
    • 8.7.3
    • 8.8.0
    • 8.8.1
    • 8.8.2
    • 8.8.3
    • 8.8.4
    • 8.8.5
    • 8.8.6
    • 9.0.0
    • 9.1.0
    • 9.2.0
    • 9.3.0
    • 9.4.0
    • 9.4.1
    Affected ranges
    • ECOSYSTEM: < 13.2.4

    Update to 13.2.4

Original sources

Check your server →