6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46721

CVE-2026-46721: Broken Access Control in extension "Frontend User Registration" (sf_register)

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46721

CVE-2026-46721:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
evoweb/sf-register	composer	>= 14.0.0, < 14.0.2	14.0.2
evoweb/sf-register	composer	< 13.2.4	13.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the FeuserController of the sf_register extension. The root cause is improper access control during the creation and editing of frontend users. Specifically, the getPropertyMappingConfiguration method was overly permissive. It used allowAllProperties(), which allowed any property from the incoming request to be mapped to the user object. Furthermore, it explicitly allowed modification of the usergroup property. An attacker could exploit this by sending a crafted request containing the usergroup parameter to assign a privileged user group to their account, thus escalating their privileges.

The fix involves two main changes in the FeuserController:

In getPropertyMappingConfiguration, the call to allowAllProperties() was replaced with allowProperties(), restricting the mappable properties to only those explicitly configured in the selected fields setting. The explicit allowance for the usergroup property was also removed.
In modifySettingsBeforeActionMethodValidators, a new check was added to throw an exception if usergroup is present in the selected fields, providing an additional layer of defense.

During an exploit, a profiler would likely show the execution of FeuserController::createAction or FeuserController::editAction, which would then call the vulnerable FeuserController::getPropertyMappingConfiguration method to process the malicious input.

Vulnerable functions

FeuserController::getPropertyMappingConfiguration

Classes/Controller/FeuserController.php

The `getPropertyMappingConfiguration` function was vulnerable because it initially allowed all properties to be mapped from the request (`allowAllProperties()`) and also explicitly allowed all sub-properties of the `usergroup` property. This allowed an attacker to pass a `usergroup` parameter in the request and have it assigned to the user. The patch fixes this by only allowing a specific list of properties and removing the explicit allowance for `usergroup`.

FeuserController::modifySettingsBeforeActionMethodValidators

Classes/Controller/FeuserController.php

This function is part of the mitigation. It was modified to explicitly check if `usergroup` is one of the fields selected for modification and throws an exception if it is. The absence of this check in the vulnerable version allowed the `usergroup` property to be processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.