CVE-2026-6553
CVE-2026-6553 · TYPO3 CMS Stores Cleartext Password in User Settings Module
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
CVSS 7.3 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
typo3 cms
- Versions
- ≥ 14.2.0, < 14.3.0: Affected (semver)
Update to 14.3.0
typo3/cms-backend Packagist
- Versions
- 14.2.0
- v14.2.0
- Affected ranges
- ECOSYSTEM: ≥ 14.2.0, < 14.3.0
Update to 14.3.0