GitHub Advisoryadvisory · Packagist

GHSA-2j54-93q2-3hjq TYPO3 CMS has Broken Access Control in Backend API

MEDIUM Published 2026-06-12 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-47352
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms-backend
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2026-06-12

Affected packages

• Packagist typo3/cms-core: < 10.4.57 → fixed in 10.4.57 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.51 → fixed in 11.5.51 • Packagist typo3/cms-core: >= 12.0.0, < 12.4.46 → fixed in 12.4.46 • Packagist typo3/cms-core: >= 13.0.0, < 13.4.31 → fixed in 13.4.31 • Packagist typo3/cms-core: >= 14.0.0, < 14.3.3 → fixed in 14.3.3 • Packagist typo3/cms-backend: < 10.4.57 → fixed in 10.4.57 • Packagist typo3/cms-backend: >= 11.0.0, < 11.5.51 → fixed in 11.5.51 • Packagist typo3/cms-backend: >= 12.0.0, < 12.4.46 → fixed in 12.4.46 • Packagist typo3/cms-backend: >= 13.0.0, < 13.4.31 → fixed in 13.4.31 • Packagist typo3/cms-backend: >= 14.0.0, < 14.3.3 → fixed in 14.3.3

Description

Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. Credits TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. Resources • TYPO3-CORE-SA-2026-015

Related

Alias · CVE (1)

  • CVE-2026-47352 Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References