Most recent entries from all

certfr-2026-avi-0722 — De multiples vulnérabilités ont été découvertes dans Typo3. Certaines d'entre elles permettent à un attaquant de provoq…

certfr-2026-avi-0722

EUVD-2026-337869

fkie_cve-2026-47352

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

GHSA-2j54-93q2-3hjq — TYPO3 CMS has Broken Access Control in Backend API

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms-backend

### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages.

### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

### Credits TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

### Resources * [TYPO3-CORE-SA-2026-015](https://typo3.org/security/advisory/typo3-core-sa-2026-015)

WID-SEC-W-2026-1835 — TYPO3 Core: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschränkungen zu umgehen, Benutzer auf schädliche Websites umzuleiten, beliebigen Code auszuführen, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.