Vulnerability-Lookup

CVE-2026-19418 (GCVE-0-2026-19418)

Vulnerability from cvelistv5 – Published: 2026-08-11 07:29 – Updated: 2026-08-11 13:21

Title

TYPO3 CMS - Broken Access Control in Backend and Install Tool

Summary

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 13:20 UTC

CWE

CWE-346 - Origin Validation Error
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

TYPO3 CNA under the mitre root

CNA scorecard B 82/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://typo3.org/security/advisory/typo3-core-sa…	related
https://github.com/TYPO3/typo3/commit/ae0abd329d5…	patch
https://github.com/TYPO3/typo3/commit/a0e8ee06a40…	patch
https://github.com/TYPO3/typo3/commit/4a75e862c58…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
TYPO3	TYPO3 CMS	Affected: 13.0.0 , < 13.4.34 (semver) Affected: 14.0.0 , < 14.3.6 (semver)	guessed
TYPO3	TYPO3 CMS	Affected: 14.0.0 , < 14.3.6 (semver)	guessed

Credits

Hổ Cao Từ Benjamin Franzke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T13:20:52.512047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T13:21:08.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-backend",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.34",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-core",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.34",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-install",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.34",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.6",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "H\u1ed5 Cao T\u1eeb"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benjamin Franzke"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cspan\u003eThe referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated \u003c/span\u003e\u003ccode\u003etypo3/\u003c/code\u003e\u003cspan\u003e directory.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\u003c/div\u003e\u003cdiv\u003eAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via \u003ccode\u003eFetch\u003c/code\u003e/\u003ccode\u003eXHR\u003c/code\u003e with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.\u003c/div\u003e"
            }
          ],
          "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T08:05:01.460Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
        },
        {
          "name": "TYPO3-CORE-SA-2020-006 (previous fix of the same protection mechanism)",
          "tags": [
            "related"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
        },
        {
          "name": "Git commit of 14.3 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in Backend and Install Tool",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-19418",
    "datePublished": "2026-08-11T07:29:37.478Z",
    "dateReserved": "2026-08-10T10:44:33.352Z",
    "dateUpdated": "2026-08-11T13:21:08.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-19418",
      "date": "2026-11-09",
      "epss": "0.00242",
      "percentile": "0.15418"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://packagist.org",
                "defaultStatus": "unaffected",
                "modules": [
                  "Backend",
                  "Install"
                ],
                "packageName": "typo3/cms-backend",
                "product": "TYPO3 CMS",
                "repo": "https://github.com/TYPO3/typo3",
                "vendor": "TYPO3",
                "versions": [
                  {
                    "lessThan": "13.4.34",
                    "status": "affected",
                    "version": "13.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "14.3.6",
                    "status": "affected",
                    "version": "14.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://packagist.org",
                "defaultStatus": "unaffected",
                "modules": [
                  "Backend",
                  "Install"
                ],
                "packageName": "typo3/cms-core",
                "product": "TYPO3 CMS",
                "repo": "https://github.com/TYPO3/typo3",
                "vendor": "TYPO3",
                "versions": [
                  {
                    "lessThan": "13.4.34",
                    "status": "affected",
                    "version": "13.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "14.3.6",
                    "status": "affected",
                    "version": "14.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://packagist.org",
                "defaultStatus": "unaffected",
                "modules": [
                  "Backend",
                  "Install"
                ],
                "packageName": "typo3/cms-install",
                "product": "TYPO3 CMS",
                "repo": "https://github.com/TYPO3/typo3",
                "vendor": "TYPO3",
                "versions": [
                  {
                    "lessThan": "14.3.6",
                    "status": "affected",
                    "version": "14.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."
          },
          {
            "lang": "es",
            "value": "La aplicaci\u00f3n del referente introducida con TYPO3-CORE-SA-2020-006 (CVE-2020-11069) se volvi\u00f3 ineficaz en TYPO3 v13.0, donde TYPO3 CMS comenz\u00f3 a servir las aplicaciones del backend y del Install Tool desde el script de entrada principal del sitio en lugar del directorio dedicado typo3/.\n\nSi una solicitud se originaba desde el backend o el propio Install Tool se determinaba comparando el referente con el directorio del script de entrada, que desde entonces es la ra\u00edz del sitio. Como consecuencia, las solicitudes originadas desde cualquier script ejecut\u00e1ndose en uno de los propios dominios de la instancia de TYPO3, como una p\u00e1gina de frontend, eran aceptadas por las rutas del backend y los puntos finales del Install Tool.\n\nAtacantes capaces de ejecutar JavaScript en uno de esos dominios, por ejemplo, explotando una vulnerabilidad de cross-site scripting, pod\u00edan invocar estos puntos finales a trav\u00e9s de Fetch/XHR con los privilegios de la sesi\u00f3n de usuario de una v\u00edctima autenticada. Este problema afecta a las versiones de TYPO3 CMS 13.0.0-13.4.33 y 14.0.0-14.3.5."
          }
        ],
        "id": "CVE-2026-19418",
        "lastModified": "2026-10-23T19:10:00.167",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-19418",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T13:20:52.512047Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-11T08:17:20.533",
        "references": [
          {
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
          },
          {
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
          },
          {
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
          },
          {
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
          },
          {
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
          }
        ],
        "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              },
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-19418",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-11T13:20:52.512047Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-11T13:20:58.330Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://packagist.org",
              "defaultStatus": "unaffected",
              "modules": [
                "Backend",
                "Install"
              ],
              "packageName": "typo3/cms-backend",
              "product": "TYPO3 CMS",
              "repo": "https://github.com/TYPO3/typo3",
              "vendor": "TYPO3",
              "versions": [
                {
                  "lessThan": "13.4.34",
                  "status": "affected",
                  "version": "13.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "14.3.6",
                  "status": "affected",
                  "version": "14.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://packagist.org",
              "defaultStatus": "unaffected",
              "modules": [
                "Backend",
                "Install"
              ],
              "packageName": "typo3/cms-core",
              "product": "TYPO3 CMS",
              "repo": "https://github.com/TYPO3/typo3",
              "vendor": "TYPO3",
              "versions": [
                {
                  "lessThan": "13.4.34",
                  "status": "affected",
                  "version": "13.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "14.3.6",
                  "status": "affected",
                  "version": "14.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://packagist.org",
              "defaultStatus": "unaffected",
              "modules": [
                "Backend",
                "Install"
              ],
              "packageName": "typo3/cms-install",
              "product": "TYPO3 CMS",
              "repo": "https://github.com/TYPO3/typo3",
              "vendor": "TYPO3",
              "versions": [
                {
                  "lessThan": "14.3.6",
                  "status": "affected",
                  "version": "14.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "13.4.34",
                      "versionStartIncluding": "13.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "14.3.6",
                      "versionStartIncluding": "14.0.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "H\u1ed5 Cao T\u1eeb"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Benjamin Franzke"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cdiv\u003e\u003cspan\u003eThe referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated \u003c/span\u003e\u003ccode\u003etypo3/\u003c/code\u003e\u003cspan\u003e directory.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\u003c/div\u003e\u003cdiv\u003eAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via \u003ccode\u003eFetch\u003c/code\u003e/\u003ccode\u003eXHR\u003c/code\u003e with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.\u003c/div\u003e"
                }
              ],
              "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346 Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                },
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-11T08:05:01.460Z",
            "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
            "shortName": "TYPO3"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
            },
            {
              "name": "TYPO3-CORE-SA-2020-006 (previous fix of the same protection mechanism)",
              "tags": [
                "related"
              ],
              "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
            },
            {
              "name": "Git commit of main branch",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
            },
            {
              "name": "Git commit of 14.3 branch",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
            },
            {
              "name": "Git commit of 13.4 branch",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "TYPO3 CMS - Broken Access Control in Backend and Install Tool",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "assignerShortName": "TYPO3",
        "cveId": "CVE-2026-19418",
        "datePublished": "2026-08-11T07:29:37.478Z",
        "dateReserved": "2026-08-10T10:44:33.352Z",
        "dateUpdated": "2026-08-11T13:21:08.298Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1036

Vulnerability from certfr_avis - Published: 2026-08-18 - Updated: 2026-08-18

De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Typo3	Typo3	typo3 versions 13.x antérieures à 13.4.34
	Typo3	Typo3	typo3 versions 14.x antérieures à 14.3.6

References

Title

Publication Time

FKIE_CVE-2026-19418

Vulnerability from fkie_nvd - Published: 2026-08-11 08:17 - Updated: 2026-10-23 19:10

Severity

7.3 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://typo3.org/security/advisory/typo3-core-sa-2020-006
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://typo3.org/security/advisory/typo3-core-sa-2026-021

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-backend",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.34",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-core",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.34",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend",
            "Install"
          ],
          "packageName": "typo3/cms-install",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "14.3.6",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n del referente introducida con TYPO3-CORE-SA-2020-006 (CVE-2020-11069) se volvi\u00f3 ineficaz en TYPO3 v13.0, donde TYPO3 CMS comenz\u00f3 a servir las aplicaciones del backend y del Install Tool desde el script de entrada principal del sitio en lugar del directorio dedicado typo3/.\n\nSi una solicitud se originaba desde el backend o el propio Install Tool se determinaba comparando el referente con el directorio del script de entrada, que desde entonces es la ra\u00edz del sitio. Como consecuencia, las solicitudes originadas desde cualquier script ejecut\u00e1ndose en uno de los propios dominios de la instancia de TYPO3, como una p\u00e1gina de frontend, eran aceptadas por las rutas del backend y los puntos finales del Install Tool.\n\nAtacantes capaces de ejecutar JavaScript en uno de esos dominios, por ejemplo, explotando una vulnerabilidad de cross-site scripting, pod\u00edan invocar estos puntos finales a trav\u00e9s de Fetch/XHR con los privilegios de la sesi\u00f3n de usuario de una v\u00edctima autenticada. Este problema afecta a las versiones de TYPO3 CMS 13.0.0-13.4.33 y 14.0.0-14.3.5."
    }
  ],
  "id": "CVE-2026-19418",
  "lastModified": "2026-10-23T19:10:00.167",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19418",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-11T13:20:52.512047Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-11T08:17:20.533",
  "references": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
    }
  ],
  "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "type": "Secondary"
    }
  ]
}

GHSA-4F2F-JR2M-J7P4

Vulnerability from github – Published: 2026-08-11 09:32 – Updated: 2026-09-01 21:30

Withdrawn 2026-09-01

Summary

Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-68jx-f42c-7599. This link is maintained to preserve external references.

Original Description

Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.

Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

Severity

7.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.4.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0"
            },
            {
              "fixed": "14.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-01T21:30:52Z",
    "nvd_published_at": "2026-08-11T08:17:20Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-68jx-f42c-7599. This link is maintained to preserve external references.\n\n## Original Description\nThe referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.",
  "id": "GHSA-4f2f-jr2m-j7p4",
  "modified": "2026-09-01T21:30:52Z",
  "published": "2026-08-11T09:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-19418.yaml"
    },
    {
      "type": "WEB",
      "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-021"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool",
  "withdrawn": "2026-09-01T21:30:52Z"
}

GHSA-68JX-F42C-7599

Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31

Summary

TYPO3 CMS - Broken Access Control in Backend and Install Tool

Details

Problem

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory.

Solution

Update to TYPO3 versions 13.4.34 LTS, 14.3.6 LTS that fix the problem described.

Credits

Thanks to Hổ Cao Từ for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.

Severity

7.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.4.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "typo3/cms-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0"
            },
            {
              "fixed": "14.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-19418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-01T21:31:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Problem\nThe referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/typo3-core-sa-2020-006) ([CVE-2020-11069](https://www.cve.org/CVERecord?id=CVE-2020-11069)) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site\u0027s main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance\u0027s own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim\u0027s user session.\n\n### Solution\nUpdate to TYPO3 versions 13.4.34 LTS, 14.3.6 LTS that fix the problem described.\n\n### Credits\nThanks to H\u1ed5 Cao T\u1eeb for reporting this issue, and to TYPO3 core \u0026 security team member Benjamin Franzke for fixing it.",
  "id": "GHSA-68jx-f42c-7599",
  "modified": "2026-09-01T21:31:42Z",
  "published": "2026-09-01T21:31:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-68jx-f42c-7599"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19418"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-19418.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TYPO3/typo3"
    },
    {
      "type": "WEB",
      "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-021"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
    },
    {
      "type": "WEB",
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "TYPO3 CMS - Broken Access Control in Backend and Install Tool"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-19418 (GCVE-0-2026-19418)

CERTFR-2026-AVI-1036

Solutions

FKIE_CVE-2026-19418

GHSA-4F2F-JR2M-J7P4

Duplicate Advisory

Original Description

GHSA-68JX-F42C-7599

Problem

Solution

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour