PT-2026-25878 · Unknown · Url Redirect Extension

Guido Schmechel · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-4202

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description The extension does not properly verify if an authenticated user has the necessary permissions to access redirects. This results in the exposure of redirect records when a page is edited. The issue concerns a failure in permission checks related to redirect access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2026-4202

GHSA-755R-R738-MJGP

Affected Products

Url Redirect Extension

References · 7

• https://typo3.org/security/advisory/typo3-ext-sa-2026-006 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-755r-r738-mjgp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4202 · Security Note
• https://github.com/ayacoo/redirect_tab/commit/085f4cbf9848241510b5032d1b330889f6de6596 · Note
• https://github.com/ayacoo/redirect_tab · Note
• https://twitter.com/CVEnew/status/2033994289890660749 · Twitter Post
• https://twitter.com/CVEarity/status/2033955949942366685 · Twitter Post