Summary
Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder seine Rechte zu erweitern.
Product
TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 2
-
High 7.5
TYPO3 CMS - Missing Authorization in lowlevel commands
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to syste…
-
Medium 5.3
TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outsid…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-72675
-
#1
Initiale Fassung
References
-
Typo3 Security Advisory vom 2026-09-07
https://news.typo3.com/security/advisory/typo3-core-sa-2026-022
-
Typo3 Security Advisory vom 2026-09-07
https://news.typo3.com/security/advisory/typo3-core-sa-2026-023