CVE-2026-47350: TYPO3 CMS - Broken Access Control in DataHandler

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-862

Description

Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected products

typo3: from 13.0.0 before 13.4.31; from 14.0.0 before 14.3.3 — fixed in 13.4.31, 14.3.3

How to fix

Upgrade to a fixed version: typo3 13.4.31, 14.3.3. Check the vendor advisory for mitigations.

References

https://github.com/TYPO3/typo3/commit/195356996a60e40aeb2cd3e45a5f5c8940d5e116
https://github.com/TYPO3/typo3/commit/c9898d2e67608eda78f8bd1f06ee9cf05a872a56
https://typo3.org/security/advisory/typo3-core-sa-2026-012

Get alerted when CVE-2026-47350 or the next vulnerability affects your stack