CVE-2026-77131CWE-319

CVE-2026-77131

published August 25, 2026

CVSS
5.3
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-08-25T13:17Z
References (1)
https://typo3.org/security/advisory/typo3-ext-sa-2026-015 · f4fb688c-4412-4426-b4b8-421ecf27b14a
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 25 AUG 09:00Z
    Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
    cvelistv5