CVE-2026-77132 TYPO3 CVE debrief

Who should care

Defenders managing TYPO3 CMS environments, especially those with low-privileged user accounts, should assess exposure and prioritize verification and remediation efforts. This includes reviewing the backend localization wizard functionality, assessing the impact of unauthorized access, and updating TYPO3 CMS to a fixed version. Additionally, defenders should consider implementing compensating controls for exposed systems and monitoring for potential data

Why it matters

CVE-2026-77132 allows authenticated, low-privileged backend users to access unauthorized records and content elements in TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34, and 14.0.0-14.3.6. Defenders should prioritize verifying exposure, especially in environments with low-privileged user accounts, and assess the impact of unauthorized access. Remediation involves updating TYPO3 CMS to a fixed version.

• Potential unauthorized access to sensitive records and content elements
• Possible data exposure or leakage
• Need for verification of backend localization wizard functionality
• Priority for updating TYPO3 CMS to a fixed version

Technical summary

The vulnerability allows authenticated, low-privileged backend users to access information about records and content elements outside their permitted range due to missing authorization checks in several AJAX routes used for the backend localization wizard. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34, and 14.0.0-14.3.6. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Defenders should prioritize verifying exposure of backend localization wizard functionality, especially in environments with low-privileged user accounts.

Defensive priority

Defenders should prioritize verifying exposure of backend localization wizard functionality, especially in environments with low-privileged user accounts, and assess the impact of unauthorized access to records and content elements.

Recommended defensive actions

• Verify exposure of backend localization wizard functionality in TYPO3 CMS environments
• Assess the impact of unauthorized access to records and content elements
• Update TYPO3 CMS to a fixed version: 10.4.60, 11.5.54, 12.4.49, 13.4.35, or 14.3.7
• Restrict access to backend localization wizard functionality for low-privileged users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected TYPO3 CMS versions and a CVSS score of 5.3. GitHub commits and TYPO3 news articles offer additional context. The vulnerability was introduced due to a lack of authorization checks in the backend localization wizard, allowing low-privileged users to access sensitive information. Defenders should verify the exposure of backend localization wizard functionality and assess the impact of unauthorized access to records and content elements.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.