# CVE-2026-47351: TYPO3 CMS broken access control in Clipboard

Source: https://junglewise.ai/threats/cve-2026-47351-typo3-cms-broken-access-control-in-clipboard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47351 · Severity: medium · CVSS 4 · Published 2026-06-09

TYPO3 CMS is a professional content management system used to build and manage websites. A security flaw in the system's clipboard functionality allowed authorized backend users to access information about files and records they were not supposed to see. This could lead to the exposure of sensitive internal data or administrative details to users with limited permissions.

Technologies: [typo3/cms-backend (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-backend), [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47351 being exploited in the wild.

**How severe is CVE-2026-47351?** Medium severity, with a CVSS score of 4, published 9 June 2026.

**Which products and versions are affected?** typo3/cms-backend (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57; typo3/cms-core (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57.

**Is there a fix for CVE-2026-47351?** Yes. typo3/cms-backend (Packagist): upgrade to 10.4.57 or later; typo3/cms-core (Packagist): upgrade to 10.4.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47351 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47351?** Check whether you run typo3/cms-backend (Packagist) or typo3/cms-core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typo3/cms-backend (Packagist): upgrade to 10.4.57 or later

  ```sh
  composer require typo3/cms-backend:^10.4.57
  ```

- typo3/cms-core (Packagist): upgrade to 10.4.57 or later

  ```sh
  composer require typo3/cms-core:^10.4.57
  ```


## Technical details

A broken access control vulnerability (CWE-862) exists in the TYPO3 CMS Media and Clipboard modules. Backend users with low privileges could insert arbitrary records and files into the system clipboard without the application performing proper read permission validation. This flaw allows an authenticated attacker to gather metadata or information about sensitive records and files that should be restricted based on their assigned roles. The issue is resolved in TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS.

## Affected products

- TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2

## Identifiers

- CVE-2026-47351
- GHSA-q93m-25xv-94hh

## Timeline

- 2026-06-09: advisory: Initial advisory published by TYPO3 and NVD
- 2026-06-12: patched: GitHub Advisory Database entry updated with patch details

## References

- [https://github.com/TYPO3/typo3/security/advisories/GHSA-q93m-25xv-94hh](https://github.com/TYPO3/typo3/security/advisories/GHSA-q93m-25xv-94hh)
- [https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3](https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3)
- [https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451](https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47351.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47351.yaml)
- [https://typo3.org/security/advisory/typo3-core-sa-2026-014](https://typo3.org/security/advisory/typo3-core-sa-2026-014)

## Related threats

- [The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool)
- [TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module)
- [TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition)
- [TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and)
- [TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath)