Auth bypass in Typo3 Cms

CVE-2026-47350

Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Vulnerability class: Broken Access Control

EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.

Affected products

Typo3 Cms — versions 13.0.0, 14.0.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

f4fb688c-4412-4426-b4b8-421ecf27b14a (patch)
f4fb688c-4412-4426-b4b8-421ecf27b14a (patch)
f4fb688c-4412-4426-b4b8-421ecf27b14a (vendor-advisory)