# CVE-2026-47349: TYPO3 CMS missing authorization in Recycler module

Source: https://junglewise.ai/threats/cve-2026-47349-typo3-cms-missing-authorization-in-recycler-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47349 · Severity: medium · CVSS 4 · Published 2026-06-09

TYPO3 CMS, a popular content management system, contains a security flaw in its Recycler module. This module allows administrators to manage and restore deleted content. An exploit allows lower-privileged backend users to restore deleted records they are not supposed to access, potentially leading to unauthorized content modification or data recovery.

Technologies: [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core), [typo3/cms-recycler (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-recycler). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47349 being exploited in the wild.

**How severe is CVE-2026-47349?** Medium severity, with a CVSS score of 4, published 9 June 2026.

**Which products and versions are affected?** typo3/cms-core (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57; typo3/cms-recycler (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57.

**Is there a fix for CVE-2026-47349?** Yes. typo3/cms-core (Packagist): upgrade to 10.4.57 or later; typo3/cms-recycler (Packagist): upgrade to 10.4.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47349 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47349?** Check whether you run typo3/cms-core (Packagist) or typo3/cms-recycler (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typo3/cms-core (Packagist): upgrade to 10.4.57 or later

  ```sh
  composer require typo3/cms-core:^10.4.57
  ```

- typo3/cms-recycler (Packagist): upgrade to 10.4.57 or later

  ```sh
  composer require typo3/cms-recycler:^10.4.57
  ```


## Technical details

A missing authorization check (CWE-862) exists in the TYPO3 Recycler module. Backend users with legitimate access to the Recycler module can bypass intended permission restrictions to restore soft-deleted records on pages or within tables for which they lack modification rights. This is a network-based attack requiring 'Low' privileges (backend user account). The vulnerability has been addressed in TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS.

## Affected products

- TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2

## Identifiers

- CVE-2026-47349
- GHSA-f34x-rx2w-7pm3

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory

## References

- [https://github.com/TYPO3/typo3/security/advisories/GHSA-f34x-rx2w-7pm3](https://github.com/TYPO3/typo3/security/advisories/GHSA-f34x-rx2w-7pm3)
- [https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8](https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8)
- [https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a](https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47349.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47349.yaml)
- [https://typo3.org/security/advisory/typo3-core-sa-2026-011](https://typo3.org/security/advisory/typo3-core-sa-2026-011)

## Related threats

- [The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool)
- [TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module)
- [TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition)
- [TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and)
- [TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath)