Description
Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | TYPO3 CMS | 13.0.0 – < 13.4.31, 14.0.0 – < 14.3.3 | 13.4.31 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-core | >= 13.0.0, < 13.4.31 | 13.4.31 | GHSA-qcmw-6rm2-5x78 |
| Packagist | typo3/cms-core | >= 14.0.0, < 14.3.3 | 14.3.3 | GHSA-qcmw-6rm2-5x78 |
Advisories 1
- WID-SEC-2026-1835 TYPO3 Core: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2026
References
- https://typo3.org/security/advisory/typo3-core-sa-2026-012 vendor-advisory
- Git commit of main branch patch
- Git commit of 13.4 branch patch