TYPO3 Shop lets visitors overwrite PayPal payment notifications
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The shop extension TYPO3 Shop by coding.ms for TYPO3 has a missing authorization check (CWE-862) in its PayPal payment notification endpoint. The endpoint accepts incoming data without verifying that it comes from the payment provider. An unauthenticated remote attacker who can reach a page with the shop's order plugin can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. Orders that are already paid are not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TYPO3 | Extension "TYPO3 Shop by coding.ms" | 6.0.0 to before 6.3.0; 5.0.0 to before 5.21.1; before 4.9.4 | 6.3.0, 5.21.1, 4.9.4 | Patch available | CNA |
- Extension "TYPO3 Shop by coding.ms" VendorTYPO3 Affected 6.0.0 to before 6.3.0; 5.0.0 to before 5.21.1; before 4.9.4 Fixed in 6.3.0, 5.21.1, 4.9.4 Patch available CNA
Remediation
Update the extension to version 6.3.0 for the 6.x line, 5.21.1 for the 5.x line, or 4.9.4 for the 4.x line, as the affected ranges from 6.0.0 before 6.3.0, from 5.0.0 before 5.21.1, and before 4.9.4 are fixed in those versions. The sources list no fixed version for other releases.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Extension "TYPO3 Shop by coding.ms" (TYPO3) Fixed in 6.3.0, 5.21.1, 4.9.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
TYPO3 Extension "TYPO3 Shop by coding.ms" — typo3.org/security/advisory/typo3-ext-sa-2026-036
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-76775 Missing authorization in TYPO3 Shop by coding.ms lets visitors cancel ordersPriority LOW 31
Timeline
- 2026-10-20 Threatist record created from CVE-2026-113468
- 2026-10-20 Alias added: GHSA-g779-m64h-785q
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: MEDIUM → LOW
References
More TYPO3 vulnerabilities
- TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
- TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
- TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
- TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
- TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
- TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-113468 · CVE Program
- CVE-2026-113468 · NVD
- FIRST EPSS
- GHSA-g779-m64h-785q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences