CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-10-25
Weakness: CWE-312

Description

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

Affected products

typo3: 14.2.0

References

https://github.com/TYPO3/typo3/commit/9a6e913f70767f63b322ae3e2d2f4e302624c291
https://typo3.org/security/advisory/typo3-core-sa-2026-005

Get alerted when CVE-2026-6553 or the next vulnerability affects your stack