TYPO3 CMS CVE-2026-47349

The attacker must be an authenticated TYPO3 backend user (PR:L confirmed by CVSS vector) with access to the Recycler backend module (mod.web_recycler). The Recycler module must be enabled and accessible to the attacker's backend user group - this is a non-default permission grant and is not available to all backend users by default. Exploitation is limited to restoring soft-deleted records; it does not enable arbitrary write or code execution. The vulnerability does not require any specific non-default CMS configuration beyond the Recycler module access grant. Exploitation is bounded by the scope of soft-deleted records visible through the Recycler - an attacker cannot restore records that were hard-deleted or that do not exist in the deleted records pool. Network access to the TYPO3 backend (typically /typo3/ path) is required, but backend interfaces are frequently not internet-exposed.

The CVSS 4.0 base score of 5.3 (Medium) is consistent with the actual risk profile. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-accessible exploitation with low complexity and no interaction required beyond holding a valid backend account - a meaningful threat surface in shared editorial environments. Impact is limited to low confidentiality and low integrity on the vulnerable system (VC:L/VI:L/VA:N) with no lateral scope change (SC:N/SI:N/SA:N), aligning with the practical impact of restoring unauthorized content rather than achieving code execution or full data disclosure. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. The tag 'Authentication Bypass' is slightly misleading - this is better characterized as authorization bypass within an authenticated session. Real-world risk is highest in multi-tenant TYPO3 installations where backend users have scoped permissions; single-tenant or internally-accessible instances face lower exposure due to the PR:L requirement. Overall, this is a genuine medium-priority finding in shared-access deployments, not a critical internet-facing threat.

An attacker with a valid TYPO3 backend account - such as a low-privilege content editor - navigates to the Recycler module and identifies soft-deleted records belonging to pages or tables outside their normal write permissions. By triggering the undelete operation, the DataHandler restores those records without checking page-insert or table-modify permissions, allowing the attacker to reintroduce deleted content into restricted areas of the site. No public exploit code has been identified, and the attack requires network access to the TYPO3 backend login endpoint plus valid credentials.