CVE-2026-112069

Broken Access Control in extension "FAL Protect" (fal_protect)

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Fal Protect

CVE-2026-112238

SQL Injection in extension "File manager" (ameos_filemanager)

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension File Manager

CVE-2026-109162

TYPO3 CMS - Security Misconfiguration in Form Framework

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Typo3 Cms

CVE-2023-50461

Authenticated Backend Configuration Injection in TYPO3 Direct Mail Leading to Arbitrary Code Execution

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Direct Mail

CVE-2023-50462

IDOR in TYPO3 Content Consent Extension v≤2.0.1

An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Content Consent

CVE-2026-85400

TYPO3 CMS - Missing Authorization in lowlevel commands

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Typo3

CVE-2026-77132

TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Typo3

CVE-2026-77146

Broken Access Control in extension "femanager" (femanager)

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "femanager"

CVE-2026-77145

Broken Access Control in extension "Events 2" (events2)

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "events 2"

CVE-2026-77144

Broken Access Control in extension "Events 2" (events2)

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "events 2"

CVE-2026-77143

Broken Access Control in extension "Forum" (pforum)

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "forum"

CVE-2026-77142

Broken Access Control in extension "Industry Directory" (yellowpages2)

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "industry Directory"

CVE-2026-77141

Broken Access Control in extension "Club Directory" (clubdirectory)

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "club Directory"

CVE-2026-77140

Broken Access Control in extension "Telephone Directory" (telephonedirectory)

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "telephone Directory"

CVE-2026-77138

Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "html5 Video Player Vs. Powermail"

CVE-2026-77137

SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "forms Export"

CVE-2026-77135

Information Disclosure in extension "femanager" (femanager)

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "femanager"

CVE-2026-77134

Broken Access Control in extension "femanager" (femanager)

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "femanager"

CVE-2026-77133

Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "femanager"

CVE-2026-77131

Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "syssy - Typo3 Monitoring & Security Checks"