CVE-2026-77141
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 25, 2026
Vendor
unknown
Description
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.