CVE-2026-77132

Deferred Deferred - Pending Action

Authorization Bypass in TYPO3 CMS via Localization Routes

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: TYPO3

Description

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77132

Affected Vendors & Products

Vendor	Product	Version / Range
typo3	cms	From 10.0.0 (inc) to 10.4.59 (inc)
typo3	cms	From 11.0.0 (inc) to 11.5.53 (inc)
typo3	cms	From 12.0.0 (inc) to 12.4.48 (inc)
typo3	cms	From 13.0.0 (inc) to 13.4.34 (inc)
typo3	cms	From 14.0.0 (inc) to 14.3.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves several AJAX routes in TYPO3 CMS that did not perform proper authorization checks during the backend localization wizard. This allowed low-privileged users to access data outside their permitted scope, potentially exposing sensitive information.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to backend localization routes in TYPO3 CMS. Review server logs for unusual requests to AJAX routes related to localization. Check for low-privileged user accounts accessing records outside their permissions. No specific commands are provided in the context.

Impact Analysis

If you are a TYPO3 CMS user with a low-privileged backend account, an attacker could exploit this to access unauthorized data, including records and content elements outside your permissions. This could lead to data leaks or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected TYPO3 versions may face compliance risks due to potential data breaches.

Mitigation Strategies

Immediately update TYPO3 CMS to a patched version (10.4.60+, 11.5.54+, 12.4.49+, 13.4.35+, or 14.3.7+). If updating is not possible, restrict access to the affected AJAX routes via server configuration or firewall rules. Review and audit user permissions to ensure low-privileged users cannot access unauthorized data.

Hi! I’m here to help you understand CVE-2026-77132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70