Database Query Vulnerability in TYPO3 Backend Module

CVE-2026-112064

What is CVE-2026-112064?

The TYPO3 backend module's consent history functionality allows users to pass sorting, grouping, and index parameters into a database query without adequate input validation. This oversight can result in potential unauthorized access to sensitive information, including password hashes of both backend and frontend users. Users with access to the history or statistics functions may exploit this lack of validation to conduct read operations on arbitrary data within the system, leading to severe data exposure risks.

References