Junglewise Threat Intelligence

CVE-2026-19418: TYPO3 CMS broken access control in backend and Install Tool

CVE-2026-19418 · Severity: high · CVSS 7.3 · Published 2026-09-01

Executive brief

TYPO3 is a widely-used enterprise content management system that powers websites and manages digital content. A flaw in its referrer validation logic allows an attacker who can inject JavaScript code into a TYPO3-hosted website (for example through a cross-site scripting vulnerability) to make unauthorized requests to the backend and Install Tool on behalf of a logged-in administrator. This could enable the attacker to modify website content, change configurations, or gain administrative access without proper authentication.

Technical details

The vulnerability is an origin validation error (CWE-346) and CSRF-like attack (CWE-352) affecting TYPO3's ReferrerEnforcer component. The root cause: in TYPO3 v13.0+, the backend application was moved from a dedicated typo3/ subdirectory to the document root, served via index.php. The referrer validation logic continued to check if requests originated from the backend by comparing the referrer directory against the entry script location—but since both are now at the site root, any request with a referrer from the same domain passes validation. An attacker who can execute JavaScript on any page of a TYPO3 instance (via XSS) can invoke backend or Install Tool endpoints using Fetch/XHR APIs with a logged-in user's session cookies, requiring the user to be already authenticated. The attack is network-accessible and requires low privilege (user authentication) and active user interaction. Fixes are available in TYPO3 versions 13.4.34 LTS and 14.3.6 LTS, which refine the referrer enforcement to account for concrete URI details.

Affected products

  • TYPO3 TYPO3 CMS Backend 13.0.0 to 13.4.33, 14.0.0 to 14.3.5
  • TYPO3 TYPO3 CMS Core 13.0.0 to 13.4.33, 14.0.0 to 14.3.5
  • TYPO3 TYPO3 CMS Install Tool 13.0.0 to 13.4.33, 14.0.0 to 14.3.5

Timeline

  • 2026-09-01: disclosed: Published via GitHub Advisory Database
  • 2026-09-01: patched: Fixed in TYPO3 13.4.34 LTS and 14.3.6 LTS

References

Related threats