Executive brief
TYPO3 CMS is a popular open-source content management system used to build and manage websites. Backend administrators without full system maintainer privileges were able to schedule sensitive configuration commands (read, set, remove) that should have been restricted, allowing them to modify system configuration and potentially escalate to system maintainer privileges. This vulnerability requires an attacker to already have backend administrator credentials.
Technical details
The vulnerability exists in TYPO3's scheduler module and three CLI commands (configuration:read, configuration:set, configuration:show/remove) in the lowlevel extension. These commands were not explicitly marked as non-schedulable, allowing backend administrators without system maintainer privilege to schedule and execute them through the scheduler interface. This permission bypass enables arbitrary system configuration modification normally restricted to system maintainers, including setting configuration values that could grant maintainer privileges or cause denial of service. The fix marks all three configuration commands as non-schedulable via the scheduler module; automated system configuration must now use CLI cronjobs instead. The vulnerability affects TYPO3 CMS versions 14.2.0 through 14.3.6.
Affected products
- TYPO3 CMS 14.2.0-14.3.6
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Commits available on GitHub for main and 14.3 branches