CVE-2026-120333

Broken Access Control in extension "Frontend User Registration" (sf_register)

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "frontend User Registration"

CVE-2026-120332

Cross-Site Scripting in extension "Mail" (mail)

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120331

Server-Side Request Forgery in extension "Mail" (mail)

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120330

Broken Access Control in extension "Mail" (mail)

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120329

Broken Access Control in extension "Mail" (mail)

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120328

Information Disclosure in extension "Mail" (mail)

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-120327

Open Redirection in extension "Mail" (mail)

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-112067

Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Accessible Form Captcha

CVE-2026-112070

Broken Access Control in extension "Analytics" (analytics)

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-113459

Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Ai Integration Extension

CVE-2026-112239

Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Ai Integration Extension

CVE-2026-113468

Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Shop By Coding.ms

CVE-2026-112071

Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Shop By Coding.ms

CVE-2026-113442

Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Fluid-form By Coding.ms

CVE-2026-112240

Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Fluid-form By Coding.ms

CVE-2026-112237

Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Kitodo.presentation

CVE-2026-112068

Insecure Direct Object Reference in extension "Analytics" (analytics)

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-112066

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-112064

SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-112065

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent