Presentation
TYPO3 drives its backend localization wizard, the tool that copies content elements from one language to another, through a set of AJAX routes. Those routes return the records and content elements that are available for translation.
HDW Sec is among the reporters of a missing authorization check on several of these routes. An authenticated backend user holding a low-privileged account could call them and read information about records and content elements that fall outside the range their permissions cover.
The TYPO3 Security Team rates the issue Medium and scores it 5.3 with a CVSS 4.0 vector. The vulnerability needs a backend account and it discloses information without granting any write access.
Issue(s)
- Several AJAX routes of the backend localization wizard did not check that the calling user was allowed to see the records they return.
- A low-privileged backend user could therefore call these routes directly and learn about records and content elements outside their permitted range.
- The impact stays confined to confidentiality. TYPO3 records no integrity and no availability effect, and the vector keeps VC:L with VI:N and VA:N.
- TYPO3 classifies the flaw as CWE-862 (missing authorization) together with CWE-200 (exposure of sensitive information to an unauthorized actor).
- The affected branches span 10.4 to 14.3, and the fix reaches the older lines only through ELTS releases, so an installation kept on 10.4, 11.5 or 12.4 needs an ELTS subscription to receive it.
- The score follows CVSS 4.0 because TYPO3 publishes its advisories in that version, while the rest of this database records CVSS 3.1 vectors.
References
- TYPO3 advisory: TYPO3-CORE-SA-2026-022
- CVE record: CVE-2026-77132
- Fixed in TYPO3 10.4.60 ELTS, 11.5.54 ELTS, 12.4.49 ELTS, 13.4.35 LTS and 14.3.7 LTS, released on 2026-09-08.