DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-19418: CVE-2026-19418: Broken Access Control and Cross-Site Request Forgery in TYPO3 CMS Core

#security #cve #cybersecurity

CVE-2026-19418: Broken Access Control and Cross-Site Request Forgery in TYPO3 CMS Core

Vulnerability ID: CVE-2026-19418
CVSS Score: 7.3
Published: 2026-09-01

CVE-2026-19418 is a high-severity origin validation vulnerability in TYPO3 CMS that enables Cross-Site Request Forgery (CSRF) and access control bypasses. Due to architectural consolidation of entry points in version 13.0, the core ReferrerEnforcer fails to isolate backend endpoints from the frontend, allowing an attacker with frontend script execution capabilities to perform unauthorized administrative actions.

TL;DR

Architectural unification of TYPO3 entry points broke the referrer-based isolation boundary, allowing frontend scripts (such as those injected via XSS) to make unauthorized administrative requests on behalf of active backend users.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-346, CWE-352
  • Attack Vector: Network (requires administrative user session & client-side script execution)
  • CVSS Score: 7.3 (High)
  • EPSS Score: 0.00213 (Percentile: 11.47%)
  • Impact: Full Administrative Compromise / Unauthorized Configuration Changes
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • TYPO3 CMS Backend and Admin/Install Tool (ext:backend, ext:install)
  • TYPO3 CMS: >= 13.0.0, < 13.4.34 (Fixed in: 13.4.34 LTS)
  • TYPO3 CMS: >= 14.0.0, < 14.3.6 (Fixed in: 14.3.6 LTS)

Code Analysis

Commit: ae0abd3

Main branch fix resolving origin bypass in TYPO3 CMS backend enforcer

Commit: a0e8ee0

14.3 branch fix backport for ReferrerEnforcer security regression

Commit: 4a75e86

13.4 branch fix backport for ReferrerEnforcer security regression

Mitigation Strategies

  • Upgrade TYPO3 CMS to fixed versions (13.4.34 LTS / 14.3.6 LTS) immediately.
  • Deploy a strict Content Security Policy (CSP) on the frontend to mitigate XSS risks.
  • Implement WAF rules to validate and restrict administrative route access based on Referer path prefixes.

Remediation Steps:

  1. Verify the current running version of TYPO3 CMS via the Backend or command line interface.
  2. Run 'composer update typo3/cms-core' or equivalent update commands to pull down the patch.
  3. Verify that the TYPO3 Core packages are updated to at least 13.4.34 or 14.3.6.
  4. Clear all system caches to ensure the new classes are fully loaded.

References

Read the full report for CVE-2026-19418 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)