GHSA-6c46-p6j5-3f49 TYPO3 CMS Allows Broken Access Control in Redirects Module

• Packagist typo3/cms-redirects: >= 14.0.0, < 14.0.2 → fixed in 14.0.2 • Packagist typo3/cms-redirects: >= 13.0.0, < 13.4.23 → fixed in 13.4.23 • Packagist typo3/cms-redirects: >= 12.0.0, < 12.4.41 → fixed in 12.4.41 • Packagist typo3/cms-redirects: >= 11.0.0, < 11.5.49 → fixed in 11.5.49 • Packagist typo3/cms-redirects: >= 10.0.0, < 10.4.55 → fixed in 10.4.55

Problem Backend users with access to the redirects module and write permission on the `sys_redirect` table were able to read, create, and modify any redirect record - without restriction to the user’s own file‑mounts or web‑mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs - facilitating phishing or other malicious redirect attacks. Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. Credits Thanks to Georg Dümmler for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. References • TYPO3-CORE-SA-2026-002