CVE-2026-112239
7.2HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862, CWE-915
Impact
Authenticated backend users can modify any property, access permission, or configuration of any page outside their authorization. Attackers need valid backend credentials with access to the affected TYPO3 extension endpoint.
Root cause
A backend endpoint accepts arbitrary fields and values for page records without verifying the user's permissions or restricting modifiable attributes.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the affected TYPO3 extension to the fixed release specified in typo3-ext-sa-2026-035. As an interim workaround, disable the extension in the Extension Manager or restrict backend access to trusted administrators.
$ composer updateAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.