Executive brief
The TYPO3 "Modules" extension contains a backend AJAX endpoint for inline editing that fails to properly restrict access to database fields based on user permissions. A low-privilege authenticated backend user can exploit this to retrieve sensitive information such as password hashes from any field in any table through error messages, potentially compromising both backend and frontend user accounts.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the inline editing AJAX endpoint of the TYPO3 "Modules" extension. The endpoint fails to validate whether the authenticated user has permission to view or edit requested database fields, allowing a low-privileged backend user to supply arbitrary table, field, and record parameters. When an invalid field is requested, the endpoint returns an error response containing the actual database value, disclosing sensitive data including password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extension's backend module. Patched versions 7.10.4 and 8.1.4 are available.
Affected products
- TYPO3 Modules extension 7.10.3 and below, 8.0.0 - 8.1.3
Timeline
- 2026-08-25: disclosed: TYPO3-EXT-SA-2026-016 published
- 2026-08-25: patched: Updated versions 7.10.4 and 8.1.4 released