CVE-2026-19418: TYPO3 CMS - Broken Access Control in Backend and Install Tool
Summary
CVE-2026-19418: TYPO3 CMS - Broken Access Control in Backend and Install Tool. Affects typo3/cms-backend versions >= 13.0.0, < 13.4.34. Fixed in 13.4.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that enables users to create and manage websites efficiently. It is known for its flexibility, scalability, and extensive features that cater to various web development needs. However, a recent vulnerability has been identified that affects the security of its backend and Install Tool, potentially allowing unauthorized access.
Vulnerability Detail
The vulnerability arises from a broken access control mechanism introduced in TYPO3 v13.0, where the referrer enforcement became ineffective. This change allowed requests from any script running on the TYPO3 instance's domain to be accepted by backend routes and Install Tool endpoints. Attackers could exploit this flaw by executing JavaScript on a vulnerable domain, leveraging cross-site scripting (XSS) vulnerabilities to invoke these endpoints with the privileges of an authenticated user session. This could lead to unauthorized access and manipulation of sensitive data.
How To Fix
Minimum fixed version
13.4.34
This is the first release that contains the fix.
composer require typo3/cms-backend:13.4.34Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
In summary, CVE-2026-19418 represents a significant security risk for TYPO3 CMS users due to broken access control in its backend and Install Tool. It is crucial to update to the latest patched versions to mitigate this vulnerability and protect sensitive data from unauthorized access.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2026-19418 is a vulnerability in TYPO3 CMS that allows unauthorized access to the backend and Install Tool due to broken access control.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive backend functionalities, potentially leading to data breaches.
You can update TYPO3 by running the command 'composer require typo3/cms-backend:^13.4.34 typo3/cms-core:^14.3.6' in your terminal.
Yes, if exploited, attackers could manipulate or access sensitive data, leading to potential data loss or corruption.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
