Typo3 vulnerabilities, page 2
412 vulnerabilities
Known vulnerabilities in Typo3 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 125 products.
RoutineCVE-2026-113459typo3 · extension "typo3 ai integration extension"Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.CVSS7.1HighEPSS0.35%RoutineCVE-2026-112070typo3 · extension "analytics"Broken Access Control in extension "Analytics" (analytics)The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.CVSS5.3MediumEPSS0.32%RoutineCVE-2026-109162typo3 · typo3 cmsTYPO3 CMS - Security Misconfiguration in Form FrameworkForms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.CVSS6.3MediumEPSS0.37%RoutineCVE-2023-50462typo3 · content_consenttypo3 content_consentAn issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.CVSS5.3MediumEPSS0.32%RoutineCVE-2023-50461typo3 · direct_mailtypo3 direct_mailAn issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.CVSS8.8HighEPSS0.51%RoutineCVE-2023-50460typo3 · femanagertypo3 femanagerAn issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.CVSS5.4MediumEPSS0.29%RoutineCVE-2023-50459typo3 · femanagertypo3 femanagerAn issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts.CVSS5.4MediumEPSS0.29%RoutineCVE-2023-45023typo3 · femanagertypo3 femanagerThe femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.CVSS4.2MediumEPSS0.19%RoutineCVE-2026-77132typo3 · typo3 cmsTYPO3 CMS - Information Disclosure via Backend Localization WizardIt has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.CVSS5.3MediumEPSS0.43%RoutineCVE-2026-85400typo3 · typo3 cmsTYPO3 CMS - Missing Authorization in lowlevel commandsBackend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.CVSS7.5HighEPSS0.46%RoutineCVE-2026-56092typo3 · extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.CVSS7.6HighEPSS0.29%RoutineCVE-2026-56093typo3 · extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.CVSS6.3MediumEPSS0.31%RoutineCVE-2026-56094typo3 · extension "apache solr for typo3 - enterprise search"Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.CVSS6.3MediumEPSS0.33%RoutineCVE-2026-56095typo3 · extension "apache solr for typo3 - enterprise search"Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.CVSS7.7HighEPSS0.32%RoutineCVE-2026-56096typo3 · extension "apache solr for typo3 - enterprise search"Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.CVSS6.3MediumEPSS0.43%RoutineCVE-2026-77127typo3 · extension "modules"Information Disclosure in extension "Modules" (modules)The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.CVSS6.0MediumEPSS0.35%RoutineCVE-2026-77128typo3 · extension "event management and registration"Broken Access Control in extension "Event management and registration" (sf_event_mgt)The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.CVSS6.3MediumEPSS0.51%RoutineCVE-2026-77129typo3 · extension "event management and registration"Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.CVSS7.7HighEPSS0.40%RoutineCVE-2026-77130typo3 · extension "syssy - typo3 monitoring & security checks"Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.CVSS5.3MediumEPSS0.35%RoutineCVE-2026-77131typo3 · extension "syssy - typo3 monitoring & security checks"Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.CVSS5.3MediumEPSS0.24%