p PatchFirst

CVE-2026-47350

CVE-2026-47350 · TYPO3 CMS - Broken Access Control in DataHandler

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3 cms

    Versions
    • ≥ 13.0.0, < 13.4.31: Affected (semver)
    • ≥ 14.0.0, < 14.3.3: Affected (semver)

    Update to 13.4.31; Update to 14.3.3

  • typo3/cms-core Packagist

    Versions
    • v13.0.0
    • v13.0.1
    • v13.1.0
    • v13.1.1
    • v13.2.0
    • v13.2.1
    • v13.3.0
    • v13.3.1
    • v13.4.0
    • v13.4.1
    • v13.4.10
    • v13.4.11
    • v13.4.12
    • v13.4.13
    • v13.4.14
    • v13.4.15
    • v13.4.16
    • v13.4.17
    • v13.4.18
    • v13.4.19
    • v13.4.2
    • v13.4.20
    • v13.4.21
    • v13.4.22
    • v13.4.23
    • v13.4.24
    • v13.4.25
    • v13.4.26
    • v13.4.27
    • v13.4.28
    • v13.4.29
    • v13.4.3
    • v13.4.30
    • v13.4.4
    • v13.4.5
    • v13.4.6
    • v13.4.7
    • v13.4.8
    • v13.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.4.31

    Update to 13.4.31

  • typo3/cms-core Packagist

    Versions
    • v14.0.0
    • v14.0.1
    • v14.0.2
    • v14.1.0
    • v14.1.1
    • v14.2.0
    • v14.3.0
    • v14.3.1
    • v14.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 14.3.3

    Update to 14.3.3

Original sources

Check your server →