Executive Summary

This vulnerability in TYPO3 CMS involves the clipboard functionality used by backend users to store records and files for copying or moving.

The issue is that while copy and move operations had proper permission checks, the clipboard insertion step did not correctly validate read permissions.

As a result, backend users could insert arbitrary records and files into the clipboard without having the necessary read permissions, potentially exposing sensitive information about those records or files.

The vulnerability affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows backend users to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which can lead to unauthorized access to sensitive information. This unauthorized exposure of data could potentially violate data protection requirements found in common standards and regulations such as GDPR and HIPAA, which mandate strict access controls and protection of personal and sensitive information.

By enabling users to view information they are not authorized to access, the vulnerability undermines the principle of least privilege and could result in non-compliance with regulations that require safeguarding sensitive data against unauthorized access.

Remediation by updating to patched TYPO3 versions and following security best practices is necessary to restore compliance and protect sensitive data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized backend users to access information about records and files they are not permitted to view.

Since the clipboard insertion does not properly check read permissions, sensitive data could be exposed to users without the correct authorization.

This unauthorized access could lead to information disclosure within your TYPO3 CMS environment, potentially compromising data confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-47351 vulnerability, you should update your TYPO3 CMS installation to one of the patched versions: 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, or 14.3.3 LTS.

The vulnerability is caused by improper permission checks in the clipboard functionality, so applying the update will ensure that only records and files the backend user has read access to can be inserted into the clipboard.

Additionally, it is recommended to follow the TYPO3 Security Guide recommendations and subscribe to the typo3-announce mailing list for ongoing security updates.

Useful 0 Not Useful 0