It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.
This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 5
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Typo3 Typo3
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
|
10.0.0
|
10.4.60
|
|
Typo3 Typo3
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
|
11.0.0
|
11.5.54
|
|
Typo3 Typo3
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
|
12.0.0
|
12.4.49
|
|
Typo3 Typo3
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
|
13.0.0
|
13.4.35
|
|
Typo3 Typo3
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
|
14.0.0
|
14.3.7
|
References 4
https://news.typo3.com/security/advisory/typo3-core-sa-2026-022
NVD
https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6
Git commit of main branch
https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086
Git commit of 14.3 branch
https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64
Git commit of 13.4 branch