Privilege Escalation Vulnerability in TYPO3 CMS
CVE-2026-85400

7.5HIGH

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
8 September 2026

What is CVE-2026-85400?

This vulnerability allows backend administrators lacking proper privileges to execute critical configuration commands, namely configuration:read, configuration:set, and configuration:show. This unauthorized access can lead to unintended modifications of system configurations typically reserved for system maintainers, potentially allowing such unauthorized users to gain elevated privileges or disrupt system services. Specific versions affected include TYPO3 CMS versions 14.2.0 through 14.3.6, emphasizing the need for immediate attention and remediation.

Affected Version(s)

TYPO3 CMS 14.2.0 < 14.3.7

References

https://news.typo3.com/security/advisory/typo3-core-sa-20...
vendor-advisory
https://github.com/TYPO3/typo3/commit/b8abe36978c63a0625a...
patch
https://github.com/TYPO3/typo3/commit/e15da7ba02185322405...
patch

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tharsanan Kurukulasingam
Elias Häußler
.