AIKIDO-2026-885460
typo3/cms-backend is vulnerable to Missing Authorization
53
Medium Risk
This Affects:
typo3/cms-backendTL;DR
Several AJAX routes used by the backend localization wizard skip authorization checks before returning record and content-element metadata. An authenticated low-privileged backend user can therefore read information about records outside their permitted range. The fix enforces authorization on those localization wizard AJAX routes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and low-privileged backend users can access the localization wizard AJAX routes.
Background info
typo3/cms-backend is vulnerable to Missing Authorization in versions 10.0.0 - 10.4.59, 11.0.0 - 11.5.53, 12.0.0 - 12.4.48, 13.0.0 - 13.4.34 and 14.0.0 - 14.3.6.
How to fix this
Upgrade the typo3/cms-backend library to the patch version. 10.4.60, 11.5.54, and 12.4.49 are ELTS-only releases; 13.4.35 and 14.3.7 are public LTS releases.
Links
Fix Commits
github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64github.com/TYPO3/typo3/commit/35e070fc654def838fbdc45562c2c095d44ca086github.com/TYPO3/typo3/commit/c232421325bd18fc4d13efac0fc018a57da2dcd6
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.