Junglewise Threat Intelligence

TYPO3 CMS broken access control in backend and install tool

Severity: high · CVSS 7.3 · Published 2026-08-11

Executive brief

TYPO3 CMS contains a flaw in how it validates referrer headers for requests to backend and install tool endpoints. An attacker who can inject JavaScript on any domain hosted by the TYPO3 instance (such as through a cross-site scripting vulnerability on a frontend page) can make unauthorized requests to backend functions with the privileges of a logged-in user's session. This could allow unauthorized modification of site content, user accounts, or system configuration.

Technical details

The vulnerability is a broken access control flaw (CWE-346: Origin Validation Error) in TYPO3's ReferrerEnforcer component. In TYPO3 v13.0+, the backend and install tool applications were moved from a dedicated `typo3/` directory to the site root and now serve through the main entry script (`/index.php`). The referrer validation logic compares incoming requests' referrer headers against the entry script directory; since that is now the site root, any request from another script on the same domain (such as a frontend page) is incorrectly accepted as same-origin. An attacker with JavaScript execution capability on any frontend page or other script endpoint within the TYPO3 instance can craft Fetch/XHR requests to backend routes or install tool endpoints, leveraging the victim's authenticated session. Patches were released: 13.4.34 and 14.3.6.

Affected products

  • TYPO3 CMS Core 13.0.0 to 13.4.33; 14.0.0 to 14.3.5

Timeline

  • 2026-08-11: disclosed: Publicly disclosed via GitHub Advisory GHSA-4f2f-jr2m-j7p4
  • 2026-08-11: patched: Patches released: 13.4.34, 14.3.6
  • 2026-09-01: other: This advisory withdrawn as duplicate of GHSA-68jx-f42c-7599

References