A flaw in TYPO3 CMS allows backend users who can access the Recycler module to restore items that they are not permitted to modify. The vulnerability provides a form of privilege escalation by enabling users to bypass deletion safeguards, potentially restoring sensitive data or altering content without proper authorization. This directly compromises data integrity and privacy for the affected sites.

Typo3 CMS versions earlier than 10.4.57, 11.0.0‑11.5.51, 12.0.0‑12.4.46, 13.0.0‑13.4.31, or 14.0.0‑14.3.3 are impacted. The vulnerability arises from the Recycler module in these releases.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, widespread exploitation is not documented. An attacker must first have backend access to the CMS and the ability to use the Recycler module; thus the attack surface is limited to authenticated users. Once accessed, they can craft a request to restore soft‑deleted records, effectively elevating their privileges to modify content they should not control.