Vulnerability-Lookup

CVE-2026-77132 (GCVE-0-2026-77132)

Vulnerability from cvelistv5 – Published: 2026-09-08 09:18 – Updated: 2026-09-08 12:22

Title

TYPO3 CMS - Information Disclosure via Backend Localization Wizard

Summary

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 12:21 UTC

CWE

CWE-862 - Missing Authorization
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

TYPO3 mitre root

References

4 references

URL	Tags
https://news.typo3.com/security/advisory/typo3-co…	vendor-advisory
https://github.com/TYPO3/typo3/commit/c232421325b…	patch
https://github.com/TYPO3/typo3/commit/35e070fc654…	patch
https://github.com/TYPO3/typo3/commit/1c63ce806d1…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
TYPO3	TYPO3 CMS	Affected: 10.0.0 , < 10.4.60 (semver) Affected: 11.0.0 , < 11.5.54 (semver) Affected: 12.0.0 , < 12.4.49 (semver) Affected: 13.0.0 , < 13.4.35 (semver) Affected: 14.0.0 , < 14.3.7 (semver) cpe:2.3:a:typo3:typo3:::::::: cpe:2.3:a:typo3:typo3:::::::: cpe:2.3:a:typo3:typo3:::::::: cpe:2.3:a:typo3:typo3:::::::: cpe:2.3:a:typo3:typo3::::::::

Credits

Oliver Hader Antariksha Akhilesh sharma “kei” David Gómez Bru Khương Anh Miro Hatachi Phan Long HDWSec El Mostafa Noujad Benjamin Kott

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T12:21:38.169127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T12:22:01.555Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Localization"
          ],
          "packageName": "typo3/cms-backend",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.60",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.54",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.49",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.35",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.7",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.60",
                  "versionStartIncluding": "10.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.54",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.49",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.35",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.7",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Oliver Hader"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Antariksha Akhilesh sharma"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "\u201ckei\u201d"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David G\u00f3mez Bru"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Kh\u01b0\u01a1ng Anh"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Miro Hatachi"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Phan Long"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "HDWSec"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "El Mostafa Noujad"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benjamin Kott"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\u0026nbsp;\u003cspan\u003eThis issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.\u003c/span\u003e"
            }
          ],
          "value": "It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\u00a0This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T09:18:41.605Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-022"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6"
        },
        {
          "name": "Git commit of 14.3 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Information Disclosure via Backend Localization Wizard",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-77132",
    "datePublished": "2026-09-08T09:18:41.605Z",
    "dateReserved": "2026-08-20T13:10:12.062Z",
    "dateUpdated": "2026-09-08T12:22:01.555Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77132",
      "date": "2026-09-08",
      "epss": "0.00409",
      "percentile": "0.34198"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-77132\",\"sourceIdentifier\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\",\"published\":\"2026-09-08T10:17:13.803\",\"lastModified\":\"2026-09-08T19:15:18.627\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\u00a0This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.\"}],\"affected\":[{\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\",\"affectedData\":[{\"vendor\":\"TYPO3\",\"product\":\"TYPO3 CMS\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://packagist.org\",\"packageName\":\"typo3/cms-backend\",\"modules\":[\"Localization\"],\"repo\":\"https://github.com/TYPO3/typo3\",\"versions\":[{\"version\":\"10.0.0\",\"lessThan\":\"10.4.60\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"11.0.0\",\"lessThan\":\"11.5.54\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"12.0.0\",\"lessThan\":\"12.4.49\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"13.0.0\",\"lessThan\":\"13.4.35\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"14.0.0\",\"lessThan\":\"14.3.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-08T12:21:38.169127Z\",\"id\":\"CVE-2026-77132\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64\",\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\"},{\"url\":\"https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086\",\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\"},{\"url\":\"https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6\",\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\"},{\"url\":\"https://news.typo3.com/security/advisory/typo3-core-sa-2026-022\",\"source\":\"f4fb688c-4412-4426-b4b8-421ecf27b14a\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-77132\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-08T12:21:38.169127Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-08T12:21:49.246Z\"}}], \"cna\": {\"title\": \"TYPO3 CMS - Information Disclosure via Backend Localization Wizard\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Oliver Hader\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Antariksha Akhilesh sharma\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"\\u201ckei\\u201d\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"David G\\u00f3mez Bru\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Kh\\u01b0\\u01a1ng Anh\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Miro Hatachi\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Phan Long\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"HDWSec\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"El Mostafa Noujad\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Benjamin Kott\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/TYPO3/typo3\", \"vendor\": \"TYPO3\", \"modules\": [\"Localization\"], \"product\": \"TYPO3 CMS\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"10.4.60\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"11.0.0\", \"lessThan\": \"11.5.54\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"12.0.0\", \"lessThan\": \"12.4.49\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"13.0.0\", \"lessThan\": \"13.4.35\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"14.0.0\", \"lessThan\": \"14.3.7\", \"versionType\": \"semver\"}], \"packageName\": \"typo3/cms-backend\", \"collectionURL\": \"https://packagist.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://news.typo3.com/security/advisory/typo3-core-sa-2026-022\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6\", \"name\": \"Git commit of main branch\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086\", \"name\": \"Git commit of 14.3 branch\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64\", \"name\": \"Git commit of 13.4 branch\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\\u00a0This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\u0026nbsp;\u003cspan\u003eThis issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"10.4.60\", \"versionStartIncluding\": \"10.0.0\"}, {\"criteria\": \"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"11.5.54\", \"versionStartIncluding\": \"11.0.0\"}, {\"criteria\": \"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.4.49\", \"versionStartIncluding\": \"12.0.0\"}, {\"criteria\": \"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"13.4.35\", \"versionStartIncluding\": \"13.0.0\"}, {\"criteria\": \"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"14.3.7\", \"versionStartIncluding\": \"14.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"f4fb688c-4412-4426-b4b8-421ecf27b14a\", \"shortName\": \"TYPO3\", \"dateUpdated\": \"2026-09-08T09:18:41.605Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-77132\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T12:22:01.555Z\", \"dateReserved\": \"2026-08-20T13:10:12.062Z\", \"assignerOrgId\": \"f4fb688c-4412-4426-b4b8-421ecf27b14a\", \"datePublished\": \"2026-09-08T09:18:41.605Z\", \"assignerShortName\": \"TYPO3\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1131

Vulnerability from certfr_avis - Published: 2026-09-08 - Updated: 2026-09-08

De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Typo3	Typo3	typo3/cms-backend versions antérieures à 10.4.60
Typo3	Typo3	typo3/cms-lowlevel versions antérieures à 14.3.7
Typo3	Typo3	typo3/cms-backend versions 12.x antérieures à 12.4.49
Typo3	Typo3	typo3/cms-backend versions 14.x antérieures à 14.3.7
Typo3	Typo3	typo3/cms-backend versions 11.x antérieures à 11.5.54
Typo3	Typo3	typo3/cms-backend versions 13.x antérieures à 13.4.35

References

Title

Publication Time

FKIE_CVE-2026-77132

Vulnerability from fkie_nvd - Published: 2026-09-08 10:17 - Updated: 2026-09-08 19:15

Severity

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6
	f4fb688c-4412-4426-b4b8-421ecf27b14a	https://news.typo3.com/security/advisory/typo3-core-sa-2026-022

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Localization"
          ],
          "packageName": "typo3/cms-backend",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.60",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.54",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.49",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.35",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.7",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account.\u00a0This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6."
    }
  ],
  "id": "CVE-2026-77132",
  "lastModified": "2026-09-08T19:15:18.627",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77132",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-08T12:21:38.169127Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-08T10:17:13.803",
  "references": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6"
    },
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-022"
    }
  ],
  "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "type": "Secondary"
    }
  ]
}

WID-SEC-W-2026-3224

Vulnerability from csaf_certbund - Published: 2026-09-07 22:00 - Updated: 2026-09-08 22:00

Summary

TYPO3 Core: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder seine Rechte zu erweitern.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-77132

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <11.5.54 ELTS TYPO3 / Core		<11.5.54 ELTS
TYPO3 Core <10.4.60 ELTS TYPO3 / Core		<10.4.60 ELTS
TYPO3 Core <13.4.35 LTS TYPO3 / Core		<13.4.35 LTS
TYPO3 Core <12.4.49 ELTS TYPO3 / Core		<12.4.49 ELTS
TYPO3 Core <14.3.7 LTS TYPO3 / Core		<14.3.7 LTS

CVE-2026-85400

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <11.5.54 ELTS TYPO3 / Core		<11.5.54 ELTS
TYPO3 Core <10.4.60 ELTS TYPO3 / Core		<10.4.60 ELTS
TYPO3 Core <13.4.35 LTS TYPO3 / Core		<13.4.35 LTS
TYPO3 Core <12.4.49 ELTS TYPO3 / Core		<12.4.49 ELTS
TYPO3 Core <14.3.7 LTS TYPO3 / Core		<14.3.7 LTS

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://news.typo3.com/security/advisory/typo3-co…	external
https://news.typo3.com/security/advisory/typo3-co…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder seine Rechte zu erweitern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3224 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3224.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3224 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3224"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-09-07",
        "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-022"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-09-07",
        "url": "https://news.typo3.com/security/advisory/typo3-core-sa-2026-023"
      }
    ],
    "source_lang": "en-US",
    "title": "TYPO3 Core: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-09-08T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-09T06:24:21.007+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3224",
      "initial_release_date": "2026-09-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-09-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-09-08T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-72675"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.4.60 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c10.4.60 ELTS",
                  "product_id": "T059145"
                }
              },
              {
                "category": "product_version",
                "name": "10.4.60 ELTS",
                "product": {
                  "name": "TYPO3 Core 10.4.60 ELTS",
                  "product_id": "T059145-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:10.4.60_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.5.54 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c11.5.54 ELTS",
                  "product_id": "T059146"
                }
              },
              {
                "category": "product_version",
                "name": "11.5.54 ELTS",
                "product": {
                  "name": "TYPO3 Core 11.5.54 ELTS",
                  "product_id": "T059146-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:11.5.54_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.4.49 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c12.4.49 ELTS",
                  "product_id": "T059147"
                }
              },
              {
                "category": "product_version",
                "name": "12.4.49 ELTS",
                "product": {
                  "name": "TYPO3 Core 12.4.49 ELTS",
                  "product_id": "T059147-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:12.4.49_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.4.35 LTS",
                "product": {
                  "name": "TYPO3 Core \u003c13.4.35 LTS",
                  "product_id": "T059148"
                }
              },
              {
                "category": "product_version",
                "name": "13.4.35 LTS",
                "product": {
                  "name": "TYPO3 Core 13.4.35 LTS",
                  "product_id": "T059148-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:13.4.35_lts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.3.7 LTS",
                "product": {
                  "name": "TYPO3 Core \u003c14.3.7 LTS",
                  "product_id": "T059149"
                }
              },
              {
                "category": "product_version",
                "name": "14.3.7 LTS",
                "product": {
                  "name": "TYPO3 Core 14.3.7 LTS",
                  "product_id": "T059149-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:14.3.7_lts"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Core"
          }
        ],
        "category": "vendor",
        "name": "TYPO3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-77132",
      "product_status": {
        "known_affected": [
          "T059146",
          "T059145",
          "T059148",
          "T059147",
          "T059149"
        ]
      },
      "release_date": "2026-09-07T22:00:00.000+00:00",
      "title": "CVE-2026-77132"
    },
    {
      "cve": "CVE-2026-85400",
      "product_status": {
        "known_affected": [
          "T059146",
          "T059145",
          "T059148",
          "T059147",
          "T059149"
        ]
      },
      "release_date": "2026-09-07T22:00:00.000+00:00",
      "title": "CVE-2026-85400"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-77132 (GCVE-0-2026-77132)

CERTFR-2026-AVI-1131

Solutions

FKIE_CVE-2026-77132

WID-SEC-W-2026-3224

Tags

Sightings

Nomenclature