CVE-2026-85400

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.2.0 through 14.3.6

Description Backend administrators lacking system maintainer privileges can schedule the configuration:read, configuration:set, and configuration:show commands. This allows for the modification of arbitrary system configurations typically restricted to system maintainers, potentially leading to the escalation of privileges to system maintainer level or a denial of service. Exploitation requires an account with administrator-level backend access.

Recommendations Update TYPO3 CMS to a version later than 14.3.6.