PT-2026-47745 · Typo3 · Typo3/Cms

Oliver Hader + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-47352

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47352

Affected Products

Typo3/Cms

References · 4

• https://github.com/TYPO3/typo3/commit/bfe7c354168f467726020ed49299dd209a455719 · Patch
• https://github.com/TYPO3/typo3/commit/17a3b7830d5931725db5fdab0cfc76d479884c96 · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47352 · Security Note