PT-2026-47742 · Typo3 · Typo3/Cms

Elias Häußler + 1 · CVE-2026-47349 · Published 2026-06-09 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.51 TYPO3 CMS versions 12.0.0 through 12.4.46 TYPO3 CMS versions 13.0.0 through 13.4.31 TYPO3 CMS versions 14.0.0 through 14.3.3

Description Backend users with access to the Recycler module can restore soft-deleted records on pages or for tables they are not authorized to modify.

Recommendations Update to version 10.4.57 or later. Update to version 11.5.52 or later. Update to version 12.4.47 or later. Update to version 13.4.32 or later. Update to version 14.3.4 or later. As a temporary workaround, restrict access to the Recycler module for unauthorized users.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47349

GHSA-F34X-RX2W-7PM3

Affected Products

Typo3/Cms

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47349.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47349.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a · Patch
• https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8 · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-011 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f34x-rx2w-7pm3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47349 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47349 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-f34x-rx2w-7pm3 · Note
• https://packagist.org · Note
• https://twitter.com/CVEnew/status/2064342507341689029 · Twitter Post