CVE-2026-6553: TYPO3 CMS Backend User Settings Module Exposes Cleartext Passwords
Summary
CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module. Affects typo3/cms-backend versions >= 14.2.0, < 14.3.0. Fixed in 14.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It provides a robust backend user interface for administrators to manage content, users, and settings. The TYPO3 CMS is known for its flexibility and extensibility, allowing developers to create custom extensions and functionalities. However, a vulnerability in the backend user settings module has been identified, which can lead to sensitive user information being stored insecurely.
Vulnerability Detail
The vulnerability arises from the backend user settings module (SetupModuleController) incorrectly treating sensitive data, such as passwords, as regular user-interface settings. This flaw allows passwords to be stored in cleartext within the 'uc' and 'user_settings' fields of the 'be_users' database table when users update their credentials. This issue is specific to TYPO3 version 14.2.0 and poses a significant risk, as it can lead to unauthorized access if the database is compromised.
How To Fix
Minimum fixed version
14.3.0
This is the first release that contains the fix.
composer require typo3/cms-backend:14.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without applying the patch. However, it is advisable to limit access to the backend user settings module until the update is applied.
Conclusion
In summary, CVE-2026-6553 is a critical vulnerability in TYPO3 CMS that exposes user passwords in cleartext due to improper handling in the backend user settings module. It is essential for users to update to the patched version and take necessary actions to secure their accounts.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2026-6553 is a vulnerability in TYPO3 CMS that allows passwords to be stored in cleartext due to improper handling of sensitive data in the backend user settings module.
The vulnerability affects TYPO3 version 14.2.0. Users should upgrade to version 14.3.0 LTS to mitigate the issue.
If exploited, this vulnerability can lead to unauthorized access to backend user accounts, as passwords are stored in an insecure manner.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If affected, update to TYPO3 version 14.3.0 LTS, execute the User Settings Scrubbing wizard, and assign new passwords to all affected backend user accounts.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
