EUVD-2026-72676Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible AJAX endpoint requiring a low-privileged authenticated backend account (PR:L); read-only metadata disclosure (C:L) with no integrity or availability impact.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
Lifecycle Timeline
3DescriptionCVE.org
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.
AnalysisAI
Unauthorized information disclosure in TYPO3 CMS backend localization wizard exposes records and content elements outside a low-privileged user's permitted access scope. Multiple AJAX endpoints in the PHP LocalizationController - used to drive the multi-step translation wizard - accept arbitrary record UIDs without performing authorization checks, allowing any authenticated backend user to query metadata about content they should not be able to see. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid TYPO3 CMS backend user account at minimum low privilege level (e.g., an editor or translator role). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 Medium with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N accurately characterizes this as a network-reachable, low-complexity flaw that requires an authenticated low-privileged backend account and yields only limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade TYPO3 CMS to the first patched release in the corresponding major branch - refer to the vendor advisory at https://news.typo3.com/security/advisory/typo3-core-sa-2026-022 for exact fix version numbers, as the references do not state them explicitly (the upstream fix is confirmed by three GitHub commits: c232421325bd18fc4d13efac0fc018a57da2dcd6, 35e070fc654def838fbdc45562c2c095d44ca086, and 1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64, but whether a tagged release has been cut should be verified directly). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vul
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today