{"uuid": "774d1d3c-3035-4073-ad12-cdd651ba3f99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-11069", "type": "seen", "source": "https://gist.github.com/alon710/e2dde3eec102d6a754efa55af1c4fe47", "content": "# CVE-2026-19418: CVE-2026-19418: Broken Access Control and Cross-Site Request Forgery in TYPO3 CMS Core\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-19418\n\n## Summary\nCVE-2026-19418 is a high-severity origin validation vulnerability in TYPO3 CMS that enables Cross-Site Request Forgery (CSRF) and access control bypasses. Due to architectural consolidation of entry points in version 13.0, the core ReferrerEnforcer fails to isolate backend endpoints from the frontend, allowing an attacker with frontend script execution capabilities to perform unauthorized administrative actions.\n\n## TL;DR\nArchitectural unification of TYPO3 entry points broke the referrer-based isolation boundary, allowing frontend scripts (such as those injected via XSS) to make unauthorized administrative requests on behalf of active backend users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-346, CWE-352\n- **Attack Vector**: Network (requires administrative user session & client-side script execution)\n- **CVSS Score**: 7.3 (High)\n- **EPSS Score**: 0.00213 (Percentile: 11.47%)\n- **Impact**: Full Administrative Compromise / Unauthorized Configuration Changes\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- TYPO3 CMS Backend and Admin/Install Tool (ext:backend, ext:install)\n- **TYPO3 CMS**: >= 13.0.0, < 13.4.34 (Fixed in: `13.4.34 LTS`)\n- **TYPO3 CMS**: >= 14.0.0, < 14.3.6 (Fixed in: `14.3.6 LTS`)\n\n## Mitigation\n\n- Upgrade TYPO3 CMS to fixed versions (13.4.34 LTS / 14.3.6 LTS) immediately.\n- Deploy a strict Content Security Policy (CSP) on the frontend to mitigate XSS risks.\n- Implement WAF rules to validate and restrict administrative route access based on Referer path prefixes.\n\n**Remediation Steps:**\n1. Verify the current running version of TYPO3 CMS via the Backend or command line interface.\n2. Run 'composer update typo3/cms-core' or equivalent update commands to pull down the patch.\n3. Verify that the TYPO3 Core packages are updated to at least 13.4.34 or 14.3.6.\n4. Clear all system caches to ensure the new classes are fully loaded.\n\n## References\n\n- [TYPO3-CORE-SA-2026-021](https://typo3.org/security/advisory/typo3-core-sa-2026-021)\n- [Related Advisory TYPO3-CORE-SA-2020-006 (CVE-2020-11069)](https://typo3.org/security/advisory/typo3-core-sa-2020-006)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-19418) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T23:32:21.500922Z"}