CVE-2026-77132: TYPO3 CMS - Information Disclosure via Backend Localization Wizard

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-09-08
Weakness: CWE-200

Description

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

Affected products

typo3: from 10.0.0 before 10.4.60; from 11.0.0 before 11.5.54; from 12.0.0 before 12.4.49; from 13.0.0 before 13.4.35; from 14.0.0 before 14.3.7 — fixed in 10.4.60, 11.5.54, 12.4.49, 13.4.35, 14.3.7

How to fix

Upgrade to a fixed version: typo3 10.4.60, 11.5.54, 12.4.49, 13.4.35. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77132 or the next vulnerability affects your stack