EUVD-2026-35396
GHSA-f34x-rx2w-7pm3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) · only source for this CVE.
CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a
Lifecycle Timeline
3DescriptionCVE.org
Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.
AnalysisAI
Insufficient authorization in TYPO3 CMS's Recycler module allows authenticated backend users to restore soft-deleted records on pages or database tables they are not permitted to modify, resulting in unauthorized integrity impact across the content management system. Affected are TYPO3 CMS versions before 10.4.57 and multiple branches through 14.3.3, with fixes delivered via two upstream commits and documented under TYPO3-CORE-SA-2026-011. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is network-accessible and requires only low-privilege backend credentials.
Technical ContextAI
The vulnerability resides in the undeleteRecord() method within typo3/sysext/core/Classes/DataHandling/DataHandler.php, the central data manipulation handler for TYPO3 CMS. Prior to the fix, this method executed record restoration without invoking checkModifyAccessList($table) (table-level write permission) or hasPermissionToInsert($table, $recordPid, $page) (page-level insert permission). Additionally, the pre-fix code retrieved only the deleted field from the parent page record - insufficient for permission evaluation - while the patched version fetches the full page row (*). CWE-862 (Missing Authorization) precisely describes the root cause: a privileged operation (restoring deleted data) was reachable without the expected access control gate. The Recycler module is a TYPO3 backend extension that surfaces soft-deleted records for authorized editors, but the underlying DataHandler did not re-validate per-table and per-page permissions at restore time.
RemediationAI
The primary fix is to upgrade TYPO3 CMS to a patched release. For the 10.4.x branch, upgrade to 10.4.57 or later, as this version is explicitly identified as the patched release in the CVE description. For branches 11.x through 14.x, the fix is present in the upstream commits (92f08d8944f1aeccf506fcd323c260448c64d7c8 and 9f17a307cf774d63ab8291fc97c6b55653b4265a at https://github.com/TYPO3/typo3); the corresponding patched release versions (inferred from the stated vulnerable ranges as 11.5.52, 12.4.47, 13.4.32, and 14.3.4 respectively) have not been independently confirmed from tagged releases. Consult the vendor advisory at https://typo3.org/security/advisory/typo3-core-sa-2026-011 for confirmed release designations. As a compensating control where immediate patching is not possible, restrict access to the TYPO3 Recycler backend module (mod.web_recycler) exclusively to fully trusted administrators via backend user group permissions - this eliminates the attack surface entirely for lower-privilege editors, though it reduces editorial functionality for legitimate recycler users.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today