# TYPO3 CMS broken access control in backend and install tool

Source: https://junglewise.ai/threats/typo3-cms-broken-access-control-in-backend-and-install-tool-aa5ab01f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.3 · Published 2026-08-11

TYPO3 CMS contains a flaw in how it validates referrer headers for requests to backend and install tool endpoints. An attacker who can inject JavaScript on any domain hosted by the TYPO3 instance (such as through a cross-site scripting vulnerability on a frontend page) can make unauthorized requests to backend functions with the privileges of a logged-in user's session. This could allow unauthorized modification of site content, user accounts, or system configuration.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.3, published 11 August 2026.

**Which products and versions are affected?** TYPO3 CMS Core 13.0.0 to 13.4.33; 14.0.0 to 14.3.5.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-11: Patches released: 13.4.34, 14.3.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw (CWE-346: Origin Validation Error) in TYPO3's ReferrerEnforcer component. In TYPO3 v13.0+, the backend and install tool applications were moved from a dedicated `typo3/` directory to the site root and now serve through the main entry script (`/index.php`). The referrer validation logic compares incoming requests' referrer headers against the entry script directory; since that is now the site root, any request from another script on the same domain (such as a frontend page) is incorrectly accepted as same-origin. An attacker with JavaScript execution capability on any frontend page or other script endpoint within the TYPO3 instance can craft Fetch/XHR requests to backend routes or install tool endpoints, leveraging the victim's authenticated session. Patches were released: 13.4.34 and 14.3.6.

## Affected products

- TYPO3 CMS Core 13.0.0 to 13.4.33; 14.0.0 to 14.3.5

## Timeline

- 2026-08-11: disclosed: Publicly disclosed via GitHub Advisory GHSA-4f2f-jr2m-j7p4
- 2026-08-11: patched: Patches released: 13.4.34, 14.3.6
- 2026-09-01: other: This advisory withdrawn as duplicate of GHSA-68jx-f42c-7599

## References

- [https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc](https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc)
- [https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7](https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7)
- [https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872](https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872)
- [https://typo3.org/security/advisory/typo3-core-sa-2020-006](https://typo3.org/security/advisory/typo3-core-sa-2020-006)
- [https://typo3.org/security/advisory/typo3-core-sa-2026-021](https://typo3.org/security/advisory/typo3-core-sa-2026-021)