Description
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | TYPO3 CMS | 14.2.0 – < 14.3.0 | 14.3.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-backend | >= 14.2.0, < 14.3.0 | 14.3.0 | GHSA-xvv6-p4wf-mvx7 |
Advisories 1
- WID-SEC-2026-1191 TYPO3 Core: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 21, 2026
References
- https://typo3.org/security/advisory/typo3-core-sa-2026-005 vendor-advisory
- Git commit of main branch patch