TYPO3 CMS EUVD-2026-72675

Exploitation requires a valid TYPO3 backend user account with administrator-level privileges - not anonymous access, not a low-privilege editor account. The attacker must also have scheduler module access, which is granted to backend admins by default in TYPO3. The system must be running TYPO3 CMS 14.2.0-14.3.6. The key limiting factor is PR:H: the vulnerability is entirely inaccessible to unauthenticated users or non-admin backend users. Multi-tenant TYPO3 deployments where backend admin accounts are distributed across multiple clients or teams represent the highest-risk scenario, as those environments deliberately separate admin from system-maintainer roles. Single-operator deployments where all admins are also system maintainers are not meaningfully exposed.

The CVSS 4.0 score of 7.5 with PR:H correctly reflects that only authenticated backend administrators can exploit this flaw, substantially narrowing the attack surface compared to typical critical-severity findings. Even a mid-sized municipal IT team in kalisz running a shared TYPO3 14.2.x-14.3.x instance with client-level admins (who lack system-maintainer status) should treat this as urgent, since the trust differential between admin and system-maintainer roles is the exact boundary this vulnerability erases. The AT:P attribute in the CVSS 4.0 vector acknowledges that the scheduler module must be accessible - a default configuration in TYPO3 - meaning the attack path is available in most standard deployments within the affected version range. EPSS data is absent from the provided intelligence. No CISA KEV listing exists and no public POC has been identified, indicating this has not been broadly weaponized. The primary real-world concern is multi-tenant or agency deployments where non-maintainer admins are provisioned, as that setup creates the exact privilege gap being exploited.

A backend administrator account holder - such as an agency content editor promoted to admin status but not granted system maintainer - navigates to the TYPO3 scheduler module and creates a new scheduled task invoking configuration:set to overwrite the admin password hash or grant a system_maintainer flag. On next scheduler execution cycle, the command runs with system-level CMS permissions, silently elevating the attacker to full system-maintainer status and granting access to all TYPO3 configuration including database credentials, encryption keys, and extension settings. No public exploit code has been identified, but the technique requires only familiarity with TYPO3's standard scheduler UI.