High

TYPO3 CMS Stores Cleartext Password in User Settings Module

Disclosed: 24.04.2026
Updated: 11.10.2026 10:22

Problem

The backend user settings module (SetupModuleController) incorrectly conflates entity data (like passwords or email address) with user-interface settings (like theme, display options) when persisting changes. As a result, passwords were stored in cleartext in the uc and user_settings fields of the be_users database table.

The cleartext data was only persisted if users changed their credentials in the backend user settings module when the TYPO3 14.2.0 release was used (not in any other version).

Solution

Update to TYPO3 version 14.3.0 LTS which fixes the problem described.

[!IMPORTANT] Manual actions required

Updating to the patched release does not retroactively clean existing data. It is recommended to execute all User Settings upgrade wizards in the TYPO3 Install Tool, including the dedicated User Settings Scrubbing wizard, which sanitizes the incorrectly persisted cleartext values from the uc and user_settings fields of the be_users table. Additionally, affected backend user accounts should be assigned new passwords.

Admin Tools → Upgrade → Upgrade Wizard → User Settings Scrubbing

Credits

TYPO3 thanks Martin Clewing for reporting this issue, and TYPO3 core team members Oliver Hader, Stefan Bürk and Garvin Hicking for fixing it.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	typo3/cms-backend	>= 14.2.0, < 14.3.0	14.3.0

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-312
Platform: Composer
Package: typo3/cms-backend
Disclosed: 24.04.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xvv6-p4wf-mvx7 - CC BY 4.0

Vulnerability history: typo3/cms-backend

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (25) in the archive

Total entries: 25
First → latest: 03.2021 09.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 6
Medium 16
Low 3

Disclosures per year

2021: 2
2022: 12
2023: 0
2024: 2
2025: 4
2026: 5

01.09.2026

TYPO3 CMS - Broken Access Control in Backend and Install Tool

High CVE-2026-19418 >= 13.0.0, < 13.4.34 13.4.34
24.04.2026

TYPO3 CMS Stores Cleartext Password in User Settings Module this entry

High · 7.5 CVE-2026-6553 >= 14.2.0, < 14.3.0 14.3.0
20.05.2025

The TYPO3 CMS Backend has Broken Authentication in Backend MFA

High · 7.2 CVE-2025-47941 >= 12.0.0, < 12.4.31, >= 13.0.0, < 13.4.12 12.4.31, 13.4.12
02.05.2022

TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name

High CVE-2009-3631 <= 4.0.13, >= 4.1.0, < 4.1.13, >= 4.2.0, < 4.2.10, >= 4.3alpha1, < 4.3beta2 4.1.13, 4.2.10, 4.3beta2
21.04.2022

TYPO3 SQL injection vulnerability on the backend

High · 8.8 CVE-2010-3662 < 4.1.14, >= 4.2.0, < 4.2.13, >= 4.3.0, < 4.3.4, >= 4.4.0, < 4.4.1 4.1.14, 4.2.13, 4.3.4, 4.4.1
21.04.2022

TYPO3 Arbitrary Code Execution vulnerability on the backend

High · 8.8 CVE-2010-3663 < 4.1.14, >= 4.2, < 4.2.13, >= 4.3, < 4.3.4, >= 4.4, < 4.4.1 4.1.14, 4.2.13, 4.3.4, 4.4.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application