TYPO3 CMS allows authenticated backend users to call several Backend API routes and retrieve file metadata without performing the necessary permission checks. Because the API does not enforce the file mount or storage restrictions that are normally applied to backend users, an attacker who can log in as a backend user gains visibility into files that are outside the scope of that user’s authorised mounts. This flaw can lead to the leaking of potentially sensitive file names, paths, and other metadata that may assist in further reconnaissance or privilege escalation. The weakness is categorized as an access control failure (CWE‑862).

The vulnerability affects TYPO3 CMS for all major release lines that are older than the following versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, and 14.3.3. Backends running any of the listed minor releases prior to these dates are exposed.

The CVSS score of 5.3 indicates a medium severity for this issue. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified from the available data, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must have legitimate backend credentials to trigger the flaw, which suggests an internal or compromised account is required. If an attacker can obtain such credentials, the flaw enables information disclosure that can contribute to broader attacks on the system.