PT-2026-70078
CVE-2026-19418
·
Published
2026-08-11
·
Updated
2026-09-01
Description by
CVSS 4.0
7.3
HighMetricsAV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
TYPO3 CMS versions 13.0.0 through 13.4.33
TYPO3 CMS versions 14.0.0 through 14.3.5
Description
Referrer enforcement became ineffective because the backend and Install Tool applications are served from the site's main entry script rather than a dedicated directory. The system determines if a request originated from the backend or Install Tool by comparing the referrer against the entry script directory, which is now the site root. Consequently, requests from any script on the instance's own domains, such as frontend pages, are accepted by backend routes and Install Tool endpoints. An attacker capable of executing JavaScript on these domains could use Fetch or XHR to invoke these endpoints using the privileges of an authenticated user's session.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾