Junglewise Threat Intelligence

CVE-2026-47349: TYPO3 CMS missing authorization in Recycler module

CVE-2026-47349 · Severity: medium · CVSS 4 · Published 2026-06-09

Technologies: Typo3 Cms-Core. Vendors: Typo3.

Executive brief

TYPO3 CMS, a popular content management system, contains a security flaw in its Recycler module. This module allows administrators to manage and restore deleted content. An exploit allows lower-privileged backend users to restore deleted records they are not supposed to access, potentially leading to unauthorized content modification or data recovery.

Technical details

A missing authorization check (CWE-862) exists in the TYPO3 Recycler module. Backend users with legitimate access to the Recycler module can bypass intended permission restrictions to restore soft-deleted records on pages or within tables for which they lack modification rights. This is a network-based attack requiring 'Low' privileges (backend user account). The vulnerability has been addressed in TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS.

Affected products

  • TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: patched
  • 2026-06-12: advisory

References