TYPO3’s referrer enforcement rule, originally slated in the CORE-SA-2020-006 alert, fails in recent releases because the backend and Install Tool are now served from the site’s main entry script rather than the dedicated typo3/ directory. The system checks whether a request originates from the backend or Install Tool by comparing the referrer to the entry script’s directory, which is the site root in v13.0+. Consequently any script running on the same domain, such as a frontend page, can be accepted by backend routes and Install Tool endpoints. If an attacker can inject JavaScript via a cross‑site scripting flaw on one of these domains, they can issue authenticated fetch or XHR calls with a victim’s session cookies, allowing them to perform privileged actions or modify site content. The vulnerability is a classic example of broken access control that undermines authentication assumptions.

TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 are impacted. The vulnerability originates from the way these releases handle entry scripts and referrer checks, and is tied to the core distribution of TYPO3 CMS.

The CVSS score of 7.3 indicates a high severity. While an EPSS score is not available, the existence of this flaw in every version of the affected releases, combined with the needed prerequisite of a cross‑site scripting vulnerability, suggests that harnessing this weakness would be straightforward for attackers with local XSS access. The flaw is not currently listed in CISA’s KEV catalog, meaning no publicly documented exploits have yet been registered. Nonetheless, once the necessary XSS vector is established, any user authenticated to the site becomes a target for further compromise.