Authorization Bypass in TYPO3 CMS Affects Multiple Versions
CVE-2026-77132

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
8 September 2026

What is CVE-2026-77132?

A security issue has been identified in several AJAX routes of TYPO3 CMS that failed to implement adequate authorization checks. This vulnerability enables authenticated, low-privileged users to access records and content that are beyond their authorized range. Exploiting this vulnerability requires an existing low-privileged backend user account. It is critical for organizations using affected TYPO3 CMS versions to apply the necessary patches to mitigate potential information disclosure risks.

Affected Version(s)

TYPO3 CMS 10.0.0 < 10.4.60

TYPO3 CMS 11.0.0 < 11.5.54

TYPO3 CMS 12.0.0 < 12.4.49

References

https://news.typo3.com/security/advisory/typo3-core-sa-20...
vendor-advisory
https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d1...
patch
https://github.com/TYPO3/typo3/commit/35e070fc654def838fb...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oliver Hader
Antariksha Akhilesh sharma
“kei”
David GĂłmez Bru
Khương Anh
Miro Hatachi
Phan Long
HDWSec
El Mostafa Noujad
Benjamin Kott
.