TYPO3 CMS suffered a broken access control flaw in the clipboard feature. Back-end users could inject arbitrary records and files into the clipboard without the system enforcing read‑permission checks, allowing them to discover and view content that should have been invisible to them. This weakness directly permits unauthorized data disclosure and leaves sensitive records and files exposed to any authenticated backend user.

The vulnerability applies to TYPO3 CMS versions 10.4.0 through 13.4.30 and 14.0.0 through 14.3.2 provided by TYPO3:TYPO3 CMS.

The flaw carries a CVSS score of 5.3, indicating a moderate severity. EPSS information is not provided, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated back‑end user with access to the TYPO3 administrative interface; through normal use of the clipboard, the attacker can gather information they are not entitled to. No remote code execution or privilege escalation beyond data exposure is described in the data available.