TYPO3 CMS - Broken Access Control in Backend and Install Tool
Problem
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session.
Solution
Update to TYPO3 versions 13.4.34 LTS, 14.3.6 LTS that fix the problem described.
Credits
Thanks to Hổ Cao Từ for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | typo3/cms-backend | >= 13.0.0, < 13.4.34 | 13.4.34 |
| Composer package | typo3/cms-core | >= 14.0.0, < 14.3.6 | 14.3.6 |
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-68jx-f42c-7599
- https://nvd.nist.gov/vuln/detail/CVE-2026-19418
- https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc
- https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7
- https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-19418.yaml
- https://github.com/TYPO3/typo3
- https://news.typo3.com/security/advisory/typo3-core-sa-2026-021
- https://typo3.org/security/advisory/typo3-core-sa-2020-006
- https://typo3.org/security/advisory/typo3-core-sa-2026-021
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-346, CWE-352- Platform
- Composer
- Package
typo3/cms-backend, typo3/cms-core- Disclosed
- 01.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-68jx-f42c-7599 - CC BY 4.0
Vulnerability history: typo3/cms-backend
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 25
- First → latest
- 03.2021 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 6
- Medium 16
- Low 3
Disclosures per year
- 2021: 2
- 2022: 12
- 2023: 0
- 2024: 2
- 2025: 4
- 2026: 5
-
TYPO3 CMS - Broken Access Control in Backend and Install Tool this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.