GHSA-4f2f-jr2m-j7p4
Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
13.4.34- Upgrade typo3/cms-core to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-68jx-f42c-7599. This link is maintained to preserve external references.
Original Description
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| typo3/cms-core | >= 13.0.0, < 13.4.34 |
13.4.34 |
| typo3/cms-core | >= 14.0.0, < 14.3.6 |
14.3.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
typo3/cms-core Packagist → 13.4.34
- composer
composer require typo3/cms-core:^13.4.34
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Other links
- github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc
- github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7
- github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026…
- news.typo3.com/security/advisory/typo3-core-sa-2026-021
- typo3.org/security/advisory/typo3-core-sa-2020-006
- typo3.org/security/advisory/typo3-core-sa-2026-021
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-68jx-f42c-7599 TYPO3 CMS - Broken Access Control in Backend and Install Tool | High | Also affects typo3/cms-core |
| GHSA-chm7-4vch-h8vr TYPO3 CMS has Broken Access Control in its Media Module | High | Also affects typo3/cms-core |
| GHSA-jh32-v29g-68pq TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework | High | Also affects typo3/cms-core |
| GHSA-c78m-c52x-jgwp TYPO3 CMS has Insecure Deserialization via Core API | Medium | Also affects typo3/cms-core |
| GHSA-jf56-v8jc-jcc5 TYPO3 CMS has Broken Access Control in its File Abstraction Layer | Low | Also affects typo3/cms-core |
| GHSA-2j54-93q2-3hjq TYPO3 CMS has Broken Access Control in Backend API | Medium | Also affects typo3/cms-core |
| GHSA-q93m-25xv-94hh TYPO3 CMS: Broken Access Control in Media Module | Medium | Also affects typo3/cms-core |
| GHSA-qcmw-6rm2-5x78 TYPO3 CMS has Broken Access Control in its DataHandler | Medium | Also affects typo3/cms-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor