CVE-2026-19418

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19418", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2026-08-10T10:44:33.352Z", "datePublished": "2026-08-11T07:29:37.478Z", "dateUpdated": "2026-08-11T13:21:08.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-08-11T08:05:01.460Z"}, "title": "TYPO3 CMS - Broken Access Control in Backend and Install Tool", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error", "type": "CWE"}, {"lang": "en", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "affected": [{"vendor": "TYPO3", "product": "TYPO3 CMS", "collectionURL": "https://packagist.org", "packageName": "typo3/cms-backend", "repo": "https://github.com/TYPO3/typo3", "modules": ["Backend", "Install"], "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.4.34", "versionType": "semver"}, {"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "TYPO3", "product": "TYPO3 CMS", "collectionURL": "https://packagist.org", "packageName": "typo3/cms-core", "repo": "https://github.com/TYPO3/typo3", "modules": ["Backend", "Install"], "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.4.34", "versionType": "semver"}, {"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "TYPO3", "product": "TYPO3 CMS", "collectionURL": "https://packagist.org", "packageName": "typo3/cms-install", "repo": "https://github.com/TYPO3/typo3", "modules": ["Backend", "Install"], "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "13.4.34", "versionStartIncluding": "13.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "14.3.6", "versionStartIncluding": "14.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated </span><code>typo3/</code><span> directory.</span></div><div>Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.</div><div>Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via <code>Fetch</code>/<code>XHR</code> with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.</div>"}]}], "references": [{"url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021", "tags": ["vendor-advisory"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006", "name": "TYPO3-CORE-SA-2020-006 (previous fix of the same protection mechanism)", "tags": ["related"]}, {"url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872", "name": "Git commit of main branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7", "name": "Git commit of 14.3 branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc", "name": "Git commit of 13.4 branch", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "H\u1ed5 Cao T\u1eeb", "type": "reporter"}, {"lang": "en", "value": "Benjamin Franzke", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T13:20:52.512047Z", "id": "CVE-2026-19418", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T13:21:08.298Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T13:20:52.512047Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T13:20:58.330Z"}}], "cna": {"title": "TYPO3 CMS - Broken Access Control in Backend and Install Tool", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "H\u1ed5 Cao T\u1eeb"}, {"lang": "en", "type": "remediation developer", "value": "Benjamin Franzke"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "modules": ["Backend", "Install"], "product": "TYPO3 CMS", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.4.34", "versionType": "semver"}, {"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "packageName": "typo3/cms-backend", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}, {"repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "modules": ["Backend", "Install"], "product": "TYPO3 CMS", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.4.34", "versionType": "semver"}, {"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "packageName": "typo3/cms-core", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}, {"repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "modules": ["Backend", "Install"], "product": "TYPO3 CMS", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.3.6", "versionType": "semver"}], "packageName": "typo3/cms-install", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021", "tags": ["vendor-advisory"]}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006", "name": "TYPO3-CORE-SA-2020-006 (previous fix of the same protection mechanism)", "tags": ["related"]}, {"url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872", "name": "Git commit of main branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7", "name": "Git commit of 14.3 branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc", "name": "Git commit of 13.4 branch", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.", "supportingMedia": [{"type": "text/html", "value": "<div><span>The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated </span><code>typo3/</code><span> directory.</span></div><div>Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.</div><div>Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via <code>Fetch</code>/<code>XHR</code> with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}, {"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "13.4.34", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "14.3.6", "versionStartIncluding": "14.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-08-11T08:05:01.460Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19418", "state": "PUBLISHED", "dateUpdated": "2026-08-11T13:21:08.298Z", "dateReserved": "2026-08-10T10:44:33.352Z", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "datePublished": "2026-08-11T07:29:37.478Z", "assignerShortName": "TYPO3"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "modules": ["Backend", "Install"], "packageName": "typo3/cms-backend", "product": "TYPO3 CMS", "repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "versions": [{"lessThan": "13.4.34", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "14.3.6", "status": "affected", "version": "14.0.0", "versionType": "semver"}]}, {"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "modules": ["Backend", "Install"], "packageName": "typo3/cms-core", "product": "TYPO3 CMS", "repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "versions": [{"lessThan": "13.4.34", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "14.3.6", "status": "affected", "version": "14.0.0", "versionType": "semver"}]}, {"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "modules": ["Backend", "Install"], "packageName": "typo3/cms-install", "product": "TYPO3 CMS", "repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "versions": [{"lessThan": "14.3.6", "status": "affected", "version": "14.0.0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."}, {"lang": "es", "value": "La aplicaci\u00f3n del referente introducida con TYPO3-CORE-SA-2020-006 (CVE-2020-11069) se volvi\u00f3 ineficaz en TYPO3 v13.0, donde TYPO3 CMS comenz\u00f3 a servir las aplicaciones del backend y del Install Tool desde el script de entrada principal del sitio en lugar del directorio dedicado typo3/.\n\nSi una solicitud se originaba desde el backend o el propio Install Tool se determinaba comparando el referente con el directorio del script de entrada, que desde entonces es la ra\u00edz del sitio. Como consecuencia, las solicitudes originadas desde cualquier script ejecut\u00e1ndose en uno de los propios dominios de la instancia de TYPO3, como una p\u00e1gina de frontend, eran aceptadas por las rutas del backend y los puntos finales del Install Tool.\n\nAtacantes capaces de ejecutar JavaScript en uno de esos dominios, por ejemplo, explotando una vulnerabilidad de cross-site scripting, pod\u00edan invocar estos puntos finales a trav\u00e9s de Fetch/XHR con los privilegios de la sesi\u00f3n de usuario de una v\u00edctima autenticada. Este problema afecta a las versiones de TYPO3 CMS 13.0.0-13.4.33 y 14.0.0-14.3.5."}], "id": "CVE-2026-19418", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19418", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T13:20:52.512047Z", "version": "2.0.3"}}]}, "published": "2026-08-11T08:17:20.533", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-352"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.4.34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.0.0,14.3.6)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "TYPO3 CMS", "source": "cna", "vendor": "TYPO3"}, "product": "typo3", "vendor": "typo3"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.0.0,14.3.6)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "TYPO3 CMS", "source": "cna", "vendor": "TYPO3"}, "product": "typo3", "vendor": "typo3"}], "created": "2026-08-11T08:30:16.936992+00:00", "updated": "2026-08-11T13:45:04.047742+00:00", "vendors": ["typo3", "typo3$PRODUCT$typo3"]}