Skip to main content
HDWSec
Medium CVE-2026-77132TYPO3-CORE-SA-2026-022

TYPO3 CMS: Missing Authorization in the Backend Localization Wizard Leading to Information Disclosure

Severity
Medium
CVSS score
5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVE number(s)
CVE-2026-77132TYPO3-CORE-SA-2026-022
Vendor
TYPO3
Product
TYPO3 CMS (Localization wizard, ext:backend / typo3/cms-backend)
Affected version(s)
10.0.0 through 10.4.59, 11.0.0 through 11.5.53, 12.0.0 through 12.4.48, 13.0.0 through 13.4.34, 14.0.0 through 14.3.6
Fixed version(s)
10.4.60 ELTS, 11.5.54 ELTS, 12.4.49 ELTS, 13.4.35 LTS and 14.3.7 LTS, released 2026-09-08
Vulnerability type
Missing Authorization (CWE-862) leading to Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Researchers
Jean-Jamil KHALIFÉ

Presentation

TYPO3 drives its backend localization wizard, the tool that copies content elements from one language to another, through a set of AJAX routes. Those routes return the records and content elements that are available for translation.

HDW Sec is among the reporters of a missing authorization check on several of these routes. An authenticated backend user holding a low-privileged account could call them and read information about records and content elements that fall outside the range their permissions cover.

The TYPO3 Security Team rates the issue Medium and scores it 5.3 with a CVSS 4.0 vector. The vulnerability needs a backend account and it discloses information without granting any write access.

Issue(s)

  • Several AJAX routes of the backend localization wizard did not check that the calling user was allowed to see the records they return.
  • A low-privileged backend user could therefore call these routes directly and learn about records and content elements outside their permitted range.
  • The impact stays confined to confidentiality. TYPO3 records no integrity and no availability effect, and the vector keeps VC:L with VI:N and VA:N.
  • TYPO3 classifies the flaw as CWE-862 (missing authorization) together with CWE-200 (exposure of sensitive information to an unauthorized actor).
  • The affected branches span 10.4 to 14.3, and the fix reaches the older lines only through ELTS releases, so an installation kept on 10.4, 11.5 or 12.4 needs an ELTS subscription to receive it.
  • The score follows CVSS 4.0 because TYPO3 publishes its advisories in that version, while the rest of this database records CVSS 3.1 vectors.

References

Our R&D hunts for vulnerabilities.

Zero-day research, reverse engineering, coordinated disclosure: discover our R&D team.