TYPO3 CMS has Broken Access Control in Backend API
### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-015](https://typo3.org/security/advisory/typo3-core-sa-2026-015)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-47352US | —OT elevated | — | ||
Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted fi… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47352.yamlWEB
- https://github.com/TYPO3/typo3PACKAGE
- https://github.com/TYPO3/typo3/commit/17a3b7830d5931725db5fdab0cfc76d479884c96WEB
- https://github.com/TYPO3/typo3/commit/bfe7c354168f467726020ed49299dd209a455719WEB
- https://github.com/TYPO3/typo3/security/advisories/GHSA-2j54-93q2-3hjqWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-47352ADVISORY
- https://typo3.org/security/advisory/typo3-core-sa-2026-015WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan