TYPO3 CMS (13.0.0 - 13.4.33) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/typo3-cms-13.0.0---13.4.33/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 00:00:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBroken Access Control in TYPO3 CMS Backend and Install Toolhttps://feed.craftedsignal.io/briefs/2026-09-typo3-broken-access/Wed, 02 Sep 2026 00:00:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-typo3-broken-access/TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 contain a broken access control vulnerability (CVE-2026-19418) that allows attackers to perform unauthorized actions by abusing ineffective referrer enforcement.TYPO3 CMS is vulnerable to a broken access control flaw identified as CVE-2026-19418, affecting versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5. This issue stems from a regression introduced when TYPO3 v13.0 transitioned to serving backend and Install Tool applications from the site root entry script rather than a dedicated directory. The application relies on referrer validation to verify the origin of administrative requests. Because the site root is now the origin for both frontend and backend requests, the validation logic fails to distinguish between them. An attacker capable of executing arbitrary JavaScript on a frontend domain, such as through a Cross-Site Scripting (XSS) vulnerability, can craft Fetch or XHR requests that bypass these origin checks. Consequently, the attacker can invoke sensitive backend or Install Tool endpoints using the session privileges of an authenticated administrator, leading to potential site takeover or configuration modification.

Impact

Successful exploitation allows an unauthenticated attacker to abuse an authenticated administrator's session to execute privileged administrative operations. This can lead to unauthorized changes to the TYPO3 instance configuration, modification of content, or full administrative takeover of the CMS, depending on the available functions within the backend and Install Tool.

Recommendation

  • Immediately upgrade TYPO3 installations to version 13.4.34 LTS or 14.3.6 LTS to resolve CVE-2026-19418.
  • Audit all public-facing pages for potential Cross-Site Scripting (XSS) vulnerabilities, as these serve as the primary delivery vector for this access control bypass.
  • Implement strict Content Security Policy (CSP) headers to restrict where the browser can load resources and where it can send asynchronous requests, mitigating the risk of unauthorized XHR/Fetch invocations.
]]>mediumadvisoryweb-applicationcmsvulnerabilitycve-2026-19418