Executive brief
TYPO3 CMS, a popular content management system, contains a security flaw in its Recycler module. This module allows administrators to manage and restore deleted content. An exploit allows lower-privileged backend users to restore deleted records they are not supposed to access, potentially leading to unauthorized content modification or data recovery.
Technical details
A missing authorization check (CWE-862) exists in the TYPO3 Recycler module. Backend users with legitimate access to the Recycler module can bypass intended permission restrictions to restore soft-deleted records on pages or within tables for which they lack modification rights. This is a network-based attack requiring 'Low' privileges (backend user account). The vulnerability has been addressed in TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS.
Affected products
- TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2
Timeline
- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-f34x-rx2w-7pm3
- https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8
- https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47349.yaml
- https://typo3.org/security/advisory/typo3-core-sa-2026-011