Description
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.

Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.

Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Published: 2026-08-11
Score: 7.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The referrer enforcement that previously limited access to TYPO3 backend and Install Tool has become ineffective in recent releases. When the main entry script is used, the system compares the request referrer against the site root, allowing any script running on the same domain to send requests to backend routes. If an attacker can inject JavaScript through an existing cross‑site scripting flaw, they can issue authenticated fetch or XHR calls to backend and Install Tool endpoints using the victim’s session cookies. This yields unauthorized manipulation of site content, configuration changes, or other privileged operations. The flaw is a classic example of broken access control that undermines authentication assumptions and escalates privileges within the CMS tenant.

Affected Systems

TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 are impacted. The vulnerability originates from the way these releases handle entry scripts and referrer checks, and is tied to the core distribution of TYPO3 CMS.

Risk and Exploitability

The CVSS score of 7.3 indicates a high severity. While an EPSS score is not available, the existence of this flaw in every version of the affected releases, combined with the needed prerequisite of a cross‑site scripting vulnerability, suggests that harnessing this weakness would be straightforward for attackers with local XSS access. The flaw is not currently listed in CISA’s KEV catalog, meaning no publicly documented exploits have yet been registered. Nonetheless, once the necessary XSS vector is established, any user authenticated to the site becomes a target for further compromise.

Generated by OpenCVE AI on August 11, 2026 at 08:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official TYPO3 Core security update released under SA‑2026‑021, which restores proper referrer enforcement for backend and Install Tool requests
  • Upgrade TYPO3 CMS to a version beyond 13.4.33 or 14.3.5 where the fix is included
  • If an update cannot be applied immediately, restrict access to the backend and Install Tool endpoints by IP or by creating a separate subdirectory and configuring the web server to deny access to those routes from other domains

Generated by OpenCVE AI on August 11, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 https://news.typo3.com/security/advisory/typo3-core-sa-2020-006 ( CVE-2020-11069 https://www.cve.org/CVERecord ) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5. The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

Tue, 11 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Description The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 https://news.typo3.com/security/advisory/typo3-core-sa-2020-006 ( CVE-2020-11069 https://www.cve.org/CVERecord ) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Title TYPO3 CMS - Broken Access Control in Backend and Install Tool
First Time appeared Typo3
Typo3 typo3
Weaknesses CWE-346
CWE-352
CPEs cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Vendors & Products Typo3
Typo3 typo3
References
Metrics cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Typo3 Typo3
cve-icon MITRE

Status: PUBLISHED

Assigner: TYPO3

Published:

Updated: 2026-08-11T08:05:01.460Z

Reserved: 2026-08-10T10:44:33.352Z

Link: CVE-2026-19418

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T08:30:16Z

Weaknesses
  • CWE-346

    Origin Validation Error

  • CWE-352

    Cross-Site Request Forgery (CSRF)