CVE-2026-112239 TYPO3 Project CVE debrief

Who should care

Defenders responsible for Typo3 installations with this extension should assess exposure and potential impact. Systems with multiple backend users or those using Typo3 with this extension are particularly relevant.

Why it matters

CVE-2026-112239 is a high-severity vulnerability in a Typo3 extension that allows authenticated backend users to change any page property without permission checks. Defenders should prioritize verifying exposure and assessing potential impact, especially for systems with multiple backend users or those using Typo3 with this extension.

• Potential unauthorized changes to page properties, including access permissions and configuration
• Increased risk of privilege escalation for authenticated backend users
• Possible disruption of site functionality or content integrity

Technical summary

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record without checking user permissions or limiting which fields can be changed. This allows any authenticated backend user to change any property of any page, including its access permissions and configuration, outside the scope granted to them. The issue affects Typo3 installations with the vulnerable extension and allows for potential unauthorized changes to page properties, including access permissions and configuration.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially for systems with multiple backend users or those using Typo3 with this extension.

Recommended defensive actions

• Verify if the Typo3 extension is installed and if the vulnerable endpoint is exposed
• Assess the potential impact of unauthorized page property changes
• Limit access to the backend endpoint and ensure proper permission checks are in place
• Monitor for suspicious activity related to page changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Additional information from the vendor or other sources may be necessary to fully assess the impact. The vulnerability allows any authenticated backend user to change any property of any page, including access permissions and configuration. The Typo3 extension's backend endpoint does not check user permissions or limit which fields can be changed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.