p PatchFirst

CVE-2026-19418

CVE-2026-19418 · TYPO3 CMS - Broken Access Control in Backend and Install Tool

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

CVSS 7.3 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3 cms

    Versions
    • ≥ 13.0.0, < 13.4.34: Affected (semver)
    • ≥ 14.0.0, < 14.3.6: Affected (semver)

    Update to 13.4.34; Update to 14.3.6

  • typo3 cms

    Versions
    • ≥ 14.0.0, < 14.3.6: Affected (semver)

    Update to 14.3.6

  • typo3/cms-backend Packagist

    Versions
    • v13.0.0
    • v13.0.1
    • v13.1.0
    • v13.1.1
    • v13.2.1
    • v13.3.0
    • v13.3.1
    • v13.4.0
    • v13.4.1
    • v13.4.10
    • v13.4.11
    • v13.4.12
    • v13.4.13
    • v13.4.14
    • v13.4.15
    • v13.4.16
    • v13.4.17
    • v13.4.18
    • v13.4.19
    • v13.4.2
    • v13.4.20
    • v13.4.21
    • v13.4.22
    • v13.4.23
    • v13.4.24
    • v13.4.25
    • v13.4.26
    • v13.4.27
    • v13.4.28
    • v13.4.29
    • v13.4.3
    • v13.4.30
    • v13.4.31
    • v13.4.32
    • v13.4.33
    • v13.4.4
    • v13.4.5
    • v13.4.6
    • v13.4.7
    • v13.4.8
    • v13.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.4.34

    Update to 13.4.34

  • typo3/cms-core Packagist

    Versions
    • v14.0.0
    • v14.0.1
    • v14.0.2
    • v14.1.0
    • v14.1.1
    • v14.2.0
    • v14.3.0
    • v14.3.1
    • v14.3.2
    • v14.3.3
    • v14.3.4
    • v14.3.5
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 14.3.6

    Update to 14.3.6

Original sources

Check your server →