CVE-2026-19418

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 13.0.0 through 13.4.33 TYPO3 CMS versions 14.0.0 through 14.3.5

Description Referrer enforcement became ineffective because the backend and Install Tool applications are served from the site's main entry script rather than a dedicated directory. The system determines if a request originated from the backend or Install Tool by comparing the referrer against the entry script directory, which is now the site root. Consequently, requests from any script on the instance's own domains, such as frontend pages, are accepted by backend routes and Install Tool endpoints. An attacker capable of executing JavaScript on these domains could use Fetch or XHR to invoke these endpoints using the privileges of an authenticated user's session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.