Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-19418: TYPO3 CMS backend may be accessed from any site page
CVE-2026-19418 · published 2 months ago
Summary
In TYPO3 versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5, the system mistakenly treats requests from normal site pages as coming from the admin backend. If an attacker can run JavaScript on your site (for example via a cross‑site scripting flaw), they could use a logged‑in admin’s browser to perform privileged actions. Update to the latest TYPO3 release that fixes the request check or apply the vendor’s recommended patch as soon as possible.
What to do
- Update typo3 cms-backend to version 13.4.34.
- Update typo3 cms-core to version 14.3.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | typo3 | typo3 cms |
< 14.3.6 < 13.4.34 |
| composer | typo3 | cms-backend |
>= 13.0.0, < 13.4.34 Fix: upgrade to 13.4.34
|
| composer | typo3 | cms-core |
>= 14.0.0, < 14.3.6 Fix: upgrade to 14.3.6
|
Original advisory text
TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
References
- https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc Patch
- https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7 Patch
- https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-19418 Vendor Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2020-006 Vendor Advisory
- https://github.com/TYPO3/typo3/security/advisories/GHSA-68jx-f42c-7599
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/C...
- https://news.typo3.com/security/advisory/typo3-core-sa-2026-021
- https://github.com/advisories/GHSA-68jx-f42c-7599
- https://typo3.org/security/advisory/typo3-core-sa-2026-021 Vendor Advisory
- https://packagist.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19418... Vendor Advisory
- https://github.com/TYPO3/typo3 Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-346Origin Validation Error
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Track software like this
Free during beta