CVE-2026-77131
Last modified
CVE-2026-77131 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TYPO3 | Extension "SYSSY - TYPO3 Monitoring & Security Checks" | < 3.0.6 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-77131?
How severe is CVE-2026-77131?
How do I fix CVE-2026-77131?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7712A security vulnerability has been detected in MindsDB up to …6.3
- CVE-2026-77127The extension fails to restrict a backend AJAX endpoint for …6
- CVE-2026-77128The extension fails to enforce enable-field restrictions on …6.3
- CVE-2026-77129The extension passes an editor-configurable email subject st…7.7
- CVE-2026-7713A vulnerability was detected in crocodilestick Calibre-Web-A…6.3
- CVE-2026-77130The extension fails to properly validate the expiration of a…5.3
- CVE-2026-77133The extension fails to restrict which frontend usergroups a …6
- CVE-2026-77134The extension fails to require the dedicated admin confirmat…8.3
- CVE-2026-77135The extension's user detail view fails to verify that a requ…8.2
- CVE-2026-77136The extension passes the raw value of a form field configure…9.5
- CVE-2026-77137The extension fails to properly sanitize user input before u…7.7
- CVE-2026-77138The extension fails to safely process untrusted client input…9.3
Are you affected by CVE-2026-77131?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST