CVE-2026-19418: TYPO3 CMS Backend Access Control Bypass via Referrer Enforcement Failure
TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5 ship a broken referrer check that became inert when v13 moved the backend entry point to the site root. Any same-domain JavaScript can invoke backend and Install Tool endpoints with an authenticated session. Fixed in 13.4.34 and 14.3.6.
Contents
TL;DR: TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 ship a broken access control in the backend and Install Tool. The referrer check that was supposed to prevent cross-site request forgery against admin endpoints became inert when TYPO3 v13 moved the backend entry point to the site root. An attacker who can run JavaScript anywhere on the same domain can now invoke backend and Install Tool routes with the victim's authenticated session. Fixed in 13.4.34 and 14.3.6.
The attack chain
In 2020, TYPO3 shipped a referrer enforcement mechanism (TYPO3-CORE-SA-2020-006, CVE-2020-11069) to protect backend and Install Tool endpoints from CSRF. The check compared the HTTP Referer header against the directory of the entry script. When the backend lived at /typo3/, this worked: a request from a frontend page at / had a different referrer origin and was rejected.
TYPO3 v13.0 changed the entry point architecture. The backend and Install Tool started being served from the site's main entry script instead of the dedicated /typo3/ directory. The referrer comparison logic was not updated to account for this. It compared against the directory of the entry script, which was now the site root. Since the referrer for any same-domain request points at the site root, the check passed for everything on that domain.
The consequence is direct. An attacker who can execute JavaScript on any page served by the TYPO3 instance, through a stored XSS vulnerability or a compromised plugin, can issue Fetch or XMLHttpRequest calls to backend routes and Install Tool endpoints. Those requests carry the victim's session cookies. The backend sees them as legitimate same-origin calls. The referrer check rubber-stamps them because the referrer matches the site root.
Who is affected
TYPO3 CMS is an enterprise-grade open source content management system written in PHP. It holds roughly 0.5% of the CMS market across all tracked websites and 0.9% among the top million sites by traffic, according to W3Techs data from July 2026. Adoption is concentrated in Germany, Austria, and Switzerland, where it dominates public sector and enterprise deployments. Over 28,500 TYPO3 sites have been matched to LinkedIn company profiles in TechnologyChecker's dataset of 50M+ domains.
The vulnerable versions are:
- TYPO3 CMS 13.0.0 through 13.4.33
- TYPO3 CMS 14.0.0 through 14.3.5
Any site running TYPO3 v13 or v14 within those ranges is affected. The Install Tool is particularly dangerous because it can modify system configuration, reset admin passwords, and execute database operations.
What to do
Update immediately:
- If you run TYPO3 13.x, upgrade to 13.4.34 or later
- If you run TYPO3 14.x, upgrade to 14.3.6 or later
If you cannot upgrade right away, restrict network access to the backend and Install Tool. The Install Tool should never be accessible from untrusted networks. Consider placing the /typo3/ path behind a VPN or IP allowlist until you can apply the patch.
Review your site for existing XSS vulnerabilities. This access control bypass turns any same-origin JavaScript execution into backend access, so pre-existing stored XSS flaws are now higher priority.
Why it matters
This is not a hypothetical risk. The attack requires only JavaScript execution on the same domain and a logged-in admin. TYPO3 sites in the public sector frequently expose frontend functionality that accepts user input. A single stored XSS on a government or corporate TYPO3 site can chain directly into backend admin actions, bypassing the CSRF protection that was supposed to be the last line of defense.
The root cause is architectural drift. A security control was built for one directory layout, the layout changed, and the control silently stopped functioning. The referrer check returned "pass" for every same-origin request because the comparison target moved along with the entry point. No error, no warning, just a check that validated nothing.
NVD enrichment was not available at the time of writing. The CVE was published on August 11, 2026 by the TYPO3 security team via the CVE List V5 feed.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.