Junglewise Threat Intelligence

CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module

CVE-2026-6553 · Severity: low · CVSS 3.1 · Published 2026-04-24

Technologies: typo3/cms-backend (Packagist). Vendors: Packagist.

Executive brief

TYPO3 CMS Stores Cleartext Password in User Settings Module

Affected products

Packagist typo3/cms-backend

Related threats

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started
TYPO3 Cross-site Scripting vulnerability in the file backend module