Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

published 2026-10-20 20 d ago modified 2026-10-20 19 d ago also EUVD-2026-104869

cvss: 6.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

Patch / fix

fixed in 1

TYPO3 Extension "TYPO3 Fluid-Form by coding.ms" 5.0.10, 6.0.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 d ago (2026-10-20)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

typo3.org /security/advisory/typo3-ext-sa-2026-033
vendor-advisory

Sources

CVE List CVE-2026-112240
NVD CVE-2026-112240

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary