CVE-2026-19418
Received Received - Intake

Referrer Bypass in TYPO3 CMS

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: TYPO3

Description
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-19418
EUVD
EUVD-2026-55971

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
typo3 typo3_cms to 13.4.33 (inc)
typo3 typo3_cms to 14.3.5 (inc)
typo3 typo3_cms 13.4.34
typo3 typo3_cms 14.3.6
typo3 typo3_cms to 9.5.16 (inc)
typo3 typo3_cms to 10.4.1 (inc)
typo3 typo3_cms 9.5.17
typo3 typo3_cms 10.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19418 is a broken access control vulnerability in TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5. It occurs because backend and Install Tool applications are now served from the site's main entry script (/index.php) instead of the dedicated typo3/ directory. This causes the referrer enforcement mechanism to incorrectly treat requests from any domain within the TYPO3 instance as same-origin, allowing attackers to forge requests via XSS.

Detection Guidance

To detect this vulnerability, check if your TYPO3 CMS version is between 13.0.0-13.4.33 or 14.0.0-14.3.5. Run commands like 'typo3/sysext/core/bin/typo3 version' or check the version in the TYPO3 backend. If affected, update to versions 13.4.34 LTS or 14.3.6 LTS immediately.

Impact Analysis

Attackers could exploit this vulnerability by tricking a logged-in user into visiting a malicious page. If the user has an active backend or Install Tool session, the attacker could send requests to backend routes or Install Tool endpoints with the user's privileges. This could lead to unauthorized actions, such as creating admin users or modifying system settings.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized access to backend and Install Tool endpoints through XSS attacks. If exploited, attackers could gain elevated privileges, potentially leading to unauthorized data access or modifications, which violates principles of least privilege and data integrity required by these regulations.

Mitigation Strategies

Update TYPO3 CMS to versions 13.4.34 LTS or 14.3.6 LTS or later to fix the broken access control vulnerability in Backend and Install Tool components.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19418. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart