PT-2026-87020

CVE-2026-77132

Published

2026-09-08

Updated

2026-09-08

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 10.0.0 through 10.4.59 TYPO3 CMS versions 11.0.0 through 11.5.53 TYPO3 CMS versions 12.0.0 through 12.4.48 TYPO3 CMS versions 13.0.0 through 13.4.34 TYPO3 CMS versions 14.0.0 through 14.3.6

Description Several AJAX routes used for the backend localization wizard lack proper authorization checks. This allows authenticated users with low privileges to access information regarding records and content elements that are outside their permitted access range.

Recommendations Update TYPO3 CMS versions 10.0.0 through 10.4.59 to a version newer than 10.4.59. Update TYPO3 CMS versions 11.0.0 through 11.5.53 to a version newer than 11.5.53. Update TYPO3 CMS versions 12.0.0 through 12.4.48 to a version newer than 12.4.48. Update TYPO3 CMS versions 13.0.0 through 13.4.34 to a version newer than 13.4.34. Update TYPO3 CMS versions 14.0.0 through 14.3.6 to a version newer than 14.3.6.

Exploitability

Exploit

Fix

Impacts

Researchers