Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

TYPO3 CMS: Unauthorized record restoration in Recycler module

CVE-2026-47349 · published 4 months ago
Summary

Certain users with access to the Recycler module in TYPO3 CMS can restore deleted records they shouldn't be able to modify. This is a security concern as it may allow unauthorized changes to sensitive data. To fix this, update to TYPO3 CMS version 10.4.57 or later, or version 11.5.52 or later, or version 12.4.47 or later, or version 13.4.32 or later, or version 14.3.4 or later.

What to do
  • Update typo3 cms-core to version 10.4.57.
  • Update typo3 cms-core to version 11.5.51.
  • Update typo3 cms-core to version 12.4.46.
  • Update typo3 cms-core to version 13.4.31.
  • Update typo3 cms-core to version 14.3.3.
  • Update typo3 cms-recycler to version 10.4.57.
  • Update typo3 cms-recycler to version 11.5.51.
  • Update typo3 cms-recycler to version 12.4.46.
  • Update typo3 cms-recycler to version 13.4.31.
  • Update typo3 cms-recycler to version 14.3.3.
  • Update typo3 typo3/cms-core to version 10.4.57.
  • Update typo3 typo3/cms-core to version 11.5.51.
  • Update typo3 typo3/cms-core to version 12.4.46.
  • Update typo3 typo3/cms-core to version 13.4.31.
  • Update typo3 typo3/cms-core to version 14.3.3.
  • Update typo3 typo3/cms-recycler to version 10.4.57.
  • Update typo3 typo3/cms-recycler to version 11.5.51.
  • Update typo3 typo3/cms-recycler to version 12.4.46.
  • Update typo3 typo3/cms-recycler to version 13.4.31.
  • Update typo3 typo3/cms-recycler to version 14.3.3.
  • Update typo3 typo3 cms to version 10.4.57 or later.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms-core < 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fix: upgrade to 10.4.57
composer typo3 cms-recycler < 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fix: upgrade to 10.4.57
Packagist typo3 typo3/cms-core < 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fix: upgrade to 10.4.57
Packagist typo3 typo3/cms-recycler < 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fix: upgrade to 10.4.57
– typo3 typo3 cms < 10.4.57
Original advisory text
TYPO3 CMS - Broken Access Control in Recycler
Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published9 Jun 2026
Updated4 Nov 2026
First seen9 Jun 2026
Sources
CVE-2026-47349 · NVD
GHSA-f34x-rx2w-7pm3 · GHSA
GHSA-f34x-rx2w-7pm3 · OSV
CVE-2026-47349 · MITRE
CVE-2026-47349 · OSV
Track software like this
Free during beta