Vulnerabilities CVE-2026-47352

CVE-2026-47352

Medium

Open

TLP:CLEAR

TYPO3 CMS - Broken Access Control in Backend API

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Details

CVSS Score: 5.3
EPSS Score ⓘ: 0.24%

14.9th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jun 9, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.