TYPO3 CMS EUVD-2026-72676

Exploitation requires a valid TYPO3 CMS backend user account at minimum low privilege level (e.g., an editor or translator role). The attacker must be able to reach the TYPO3 backend interface, which is typically served at the /typo3/ path and is usually not publicly accessible without credentials. The vulnerability is specific to the localization wizard AJAX endpoints and does not affect the TYPO3 frontend. Impact is strictly limited to read-only disclosure of record and content element metadata (language options, localization modes, content structure) - no write access, no code execution, and no credential exposure are achievable through this flaw. Sites where backend access is restricted to a small, thoroughly vetted user group face significantly reduced practical risk. The CVSS PR:L metric confirms that at minimum a low-privileged authenticated account is required; there is no unauthenticated exploitation path.

The CVSS 4.0 score of 5.3 Medium with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N accurately characterizes this as a network-reachable, low-complexity flaw that requires an authenticated low-privileged backend account and yields only limited confidentiality impact. The key risk-limiting factor is the mandatory low-privileged backend account: in most TYPO3 deployments the backend is not publicly exposed without credentials, constraining the attacker pool to insiders, compromised editors, or credential-stuffing targets. Even a mid-sized municipal IT team in bytom running a public-facing TYPO3 portal should treat this as a scheduled, non-emergency patch rather than an incident - the leaked information is structural record metadata (available languages, localization modes, content element relationships), not credentials, PII, or session tokens. No CISA KEV listing exists, no EPSS data is provided in the input, and no public proof-of-concept code has been identified. SSVC dimensions support a SCHEDULED or DEFER cadence: exploitation is not automatable without valid credentials, technical impact is partial (confidentiality only), and there is no known active exploitation. The CVSS vector is consistent with the description and no material discrepancies between the stated CVSS and the described behavior are observed.

An authenticated TYPO3 editor - for example, a user permitted to manage only one site section - opens browser developer tools and directly submits a GET request to the wizard_localization_get_sources AJAX endpoint, supplying record UIDs belonging to pages in a different site tree or restricted intranet section. The endpoint returns source language and record metadata for the queried content element without checking the user's page access rights. No specialized tooling is required beyond a browser; the attack is reproducible by any backend user aware of the endpoint URLs.