CVE-2026-47352
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data, posing a risk to the privacy and security of the organization.
Recommendation
It is recommended to update TYPO3 CMS to versions 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 to mitigate this vulnerability.
Original NVD description (English source)
Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.