# CVE-2016-5091: TYPO3 CMS missing access check in Extbase

Source: https://junglewise.ai/threats/cve-2016-5091-typo3-cms-missing-access-check-in-extbase  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-5091 · Severity: high · CVSS 8.1 · Published 2017-01-23

A critical security flaw was found in TYPO3 CMS, a popular web content management system. The vulnerability exists in the Extbase framework, which handles how the system processes specific web requests. An attacker could exploit this to bypass security checks, potentially allowing them to steal sensitive data or take full control of the website. Organizations using affected versions should update immediately to prevent unauthorized access or service disruption.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2016-5091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-5091 being exploited in the wild.

**How severe is CVE-2016-5091?** High severity, with a CVSS score of 8.1, published 23 January 2017.

**Which products and versions are affected?** typo3/cms-extbase (Packagist) ECOSYSTEM:introduced=0,fixed=6.2.24.

**Is there a fix for CVE-2016-5091?** Yes. typo3/cms-extbase (Packagist): upgrade to 6.2.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-5091 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-5091?** Check whether you run typo3/cms-extbase (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typo3/cms-extbase (Packagist): upgrade to 6.2.24 or later

  ```sh
  composer require typo3/cms-extbase:^6.2.24
  ```


## Technical details

A missing access check vulnerability exists in the Extbase request handling component of TYPO3 CMS. The root cause is a failure to validate requested controller/action combinations, allowing an attacker to trigger arbitrary Extbase actions via crafted HTTP requests. If a TYPO3 installation has at least one publicly accessible Extbase plugin or module, the vulnerability can be exploited without authentication; otherwise, it requires an authenticated backend user with access to an Extbase-based module. Successful exploitation can lead to full remote code execution (RCE) or sensitive data exposure depending on the available actions. The issue is resolved in versions 6.2.24, 7.6.8, and 8.1.1.

## Affected products

- TYPO3 TYPO3 CMS 4.3.0 to 6.2.23, 7.x to 7.6.7, 8.1.1

## Identifiers

- CVE-2016-5091
- GHSA-jxg5-35fj-ccwf

## Timeline

- 2016-05-24: advisory: Vendor security bulletin TYPO3-CORE-SA-2016-013 released
- 2016-05-24: patched: Fixed versions 6.2.24, 7.6.8, and 8.1.1 released
- 2017-01-23: disclosed: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/05/25/4](http://www.openwall.com/lists/oss-security/2016/05/25/4)
- [http://www.openwall.com/lists/oss-security/2016/05/26/2](http://www.openwall.com/lists/oss-security/2016/05/26/2)
- [https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/](https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/)