CVE-2026-19418: TYPO3 CMS - Broken Access Control in Backend and Install Tool

Vulnerability summary

CVE-2026-19418 is a high (CVSS 7.3) Origin Validation Error vulnerability in typo3 typo3 cms. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 11-08-2026
   Last modifiedVulnerability information updated.

Description

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

• CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
• CWE-352Cross-Site Request ForgeryThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.