TYPO3 CMS Access Control Vulnerability: Unauthorized Page Modification in Localization
Summary
GHSA-772m-43f3-hmf8: TYPO3 Broken Access Control in Localization Handling. Affects typo3/cms versions >= 8.0.0, < 8.7.23. Fixed in 8.7.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) designed for enterprise-level websites. It offers a robust framework for managing content, supporting multiple languages, and providing extensive customization options. However, a recent vulnerability has been identified that affects the localization handling, allowing unauthorized modifications to pages in the default language by users with restricted language access.
Vulnerability Detail
The vulnerability arises from a broken access control mechanism in TYPO3's localization handling. Specifically, backend users with limited access to certain languages can still modify and create pages in the default language, which should not be permitted. This flaw can lead to unauthorized changes in content, potentially compromising the integrity of the website. A valid backend user account is required to exploit this vulnerability, making it crucial for administrators to review user permissions carefully.
How To Fix
Minimum fixed version
8.7.23
This is the first release that contains the fix.
composer require typo3/cms:8.7.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, administrators can restrict backend user permissions more tightly, ensuring that users do not have access to modify content in the default language. This can be done by reviewing and adjusting user roles and permissions in the TYPO3 backend settings.
Conclusion
The TYPO3 CMS vulnerability related to broken access control in localization handling poses a significant risk to content integrity. It is essential for users to update to the latest patched version to mitigate this risk. Additionally, implementing stricter user permissions can serve as a temporary measure until the update is applied.
See every vulnerability recorded for typo3/cms →
FAQ
The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
Any TYPO3 CMS installation that is running versions between 8.0.0 and 8.7.22 is affected by this vulnerability.
If immediate updates are not possible, consider implementing stricter user permissions as a temporary workaround.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized content modifications, which can lead to misinformation, brand reputation damage, and potential legal issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
