CVE-2026-47351: TYPO3 CMS - Broken Access Control in Clipboard

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-09 · updated 2026-07-23
Weakness: CWE-200

Description

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Affected products

typo3: from 10.4.0 before 13.4.31; from 14.0.0 before 14.3.3 — fixed in 13.4.31, 14.3.3

How to fix

Upgrade to a fixed version: typo3 13.4.31, 14.3.3. Check the vendor advisory for mitigations.

References

https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3
https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451
https://typo3.org/security/advisory/typo3-core-sa-2026-014

Get alerted when CVE-2026-47351 or the next vulnerability affects your stack