Backend AJAX Endpoint Vulnerability in TYPO3 Extension

CVE-2026-77127

What is CVE-2026-77127?

The TYPO3 extension contains a flaw in its backend AJAX endpoint that permits unauthorized access to sensitive database fields. This vulnerability arises because the backend AJAX endpoint fails to adequately restrict inline editing functions to only those fields the user is authorized to view or edit. As a result, a low-privileged authenticated backend user can exploit this weakness by manipulating table and field parameters. This manipulation may trigger an error that reveals confidential information, including backend and frontend user password hashes, posing a significant risk of unauthorized access to the system.

References