Authorization Bypass in TYPO3 Proxy Extension

CVE-2026-112237

What is CVE-2026-112237?

This vulnerability allows an unauthenticated attacker to exploit a flaw in the TYPO3 extension that provides a public proxy endpoint. The endpoint fetches URLs on behalf of the visitor but fails to apply proper authorization checks for one specific HTTP request method. As a result, the attacker can manipulate the endpoint to send requests to any internal or external hosts, receiving the status code and response headers in return. This capability enables adversaries to probe internal systems and gather information about the network infrastructure, posing significant security risks.

References