GitHub Advisoryadvisory · Packagist

GHSA-f34x-rx2w-7pm3 TYPO3 CMS has Broken Access Control in the Recycler Module

MEDIUM Published 2026-06-12 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-47349
Ecosystem
Packagist
Packages
typo3/cms-core, typo3/cms-recycler
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2026-06-12

Affected packages

• Packagist typo3/cms-core: < 10.4.57 → fixed in 10.4.57 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.51 → fixed in 11.5.51 • Packagist typo3/cms-core: >= 12.0.0, < 12.4.46 → fixed in 12.4.46 • Packagist typo3/cms-core: >= 13.0.0, < 13.4.31 → fixed in 13.4.31 • Packagist typo3/cms-core: >= 14.0.0, < 14.3.3 → fixed in 14.3.3 • Packagist typo3/cms-recycler: < 10.4.57 → fixed in 10.4.57 • Packagist typo3/cms-recycler: >= 11.0.0, < 11.5.51 → fixed in 11.5.51 • Packagist typo3/cms-recycler: >= 12.0.0, < 12.4.46 → fixed in 12.4.46 • Packagist typo3/cms-recycler: >= 13.0.0, < 13.4.31 → fixed in 13.4.31 • Packagist typo3/cms-recycler: >= 14.0.0, < 14.3.3 → fixed in 14.3.3

Description

Problem Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team member Elias Häußler for fixing it. Resources • TYPO3-CORE-SA-2026-011

Related

Alias · CVE (1)

  • CVE-2026-47349 Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References