Read the docs
TI-2026-15834 Aliases CVE-2026-19418GHSA-68jx-f42c-7599

TYPO3 CMS - Broken Access Control in Backend and Install Tool

Priority LOW 34CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346 and CWE-352.

Summary

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed TYPO3 CMS (TYPO3): 13.4.34, 14.3.6typo3/cms-backend (Packagist): 13.4.34+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3TYPO3 CMS13.0.0 to before 13.4.34; 14.0.0 to before 14.3.613.4.34, 14.3.6Patch availableCNA
TYPO3TYPO3 CMS13.0.0 to before 13.4.34; 14.0.0 to before 14.3.613.4.34, 14.3.6Patch availableCNA
TYPO3TYPO3 CMS14.0.0 to before 14.3.614.3.6Patch availableCNA
—typo3/cms-backend (Packagist)13.0.0 to before 13.4.3413.4.34Patch availableGHSA-68jx-f42c-7599
—typo3/cms-core (Packagist)14.0.0 to before 14.3.614.3.6Patch availableGHSA-68jx-f42c-7599
  • TYPO3 CMS VendorTYPO3 Affected 13.0.0 to before 13.4.34; 14.0.0 to before 14.3.6 Fixed in 13.4.34, 14.3.6 Patch available CNA
  • TYPO3 CMS VendorTYPO3 Affected 13.0.0 to before 13.4.34; 14.0.0 to before 14.3.6 Fixed in 13.4.34, 14.3.6 Patch available CNA
  • TYPO3 CMS VendorTYPO3 Affected 14.0.0 to before 14.3.6 Fixed in 14.3.6 Patch available CNA
  • typo3/cms-backend (Packagist) Vendor— Affected 13.0.0 to before 13.4.34 Fixed in 13.4.34 Patch available GHSA-68jx-f42c-7599
  • typo3/cms-core (Packagist) Vendor— Affected 14.0.0 to before 14.3.6 Fixed in 14.3.6 Patch available GHSA-68jx-f42c-7599

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*——TYPO3
  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions — — ·TYPO3

Remediation

  • Fix · CNA TYPO3 CMS (TYPO3) Fixed in 13.4.34, 14.3.6
  • Fix · CNA TYPO3 CMS (TYPO3) Fixed in 13.4.34, 14.3.6
  • Fix · CNA TYPO3 CMS (TYPO3) Fixed in 14.3.6
  • Fix · GHSA-68jx-f42c-7599 typo3/cms-backend (Packagist) Fixed in 13.4.34 Advisory →
  • Fix · GHSA-68jx-f42c-7599 typo3/cms-core (Packagist) Fixed in 14.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19418
  2. 2026-10-03 Alias added: GHSA-68jx-f42c-7599

References

Patch 3

Advisory 2

Other 5

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences