CVE-2026-19418: TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until upgraded, prevent JavaScript injection on TYPO3 domains (e.g., mitigate any cross-site scripting vulnerabilities) because attackers with script execution on a site domain could invoke backend routes and Install Tool endpoints via Fetch/XHR using an authenticated victim's session.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19418?
CVE-2026-19418 has a severity score of 60, indicating a moderate risk level.
How do I fix CVE-2026-19418?
To fix CVE-2026-19418, upgrade to the latest version of TYPO3 CMS that addresses the broken access control issues.
What causes CVE-2026-19418 in TYPO3?
CVE-2026-19418 is caused by ineffective referrer enforcement in the TYPO3 backend and Install Tool applications.
What is the impact of CVE-2026-19418?
The impact of CVE-2026-19418 allows unauthorized access to the TYPO3 backend and Install Tool, potentially compromising the site.
Is CVE-2026-19418 related to previous vulnerabilities?
Yes, CVE-2026-19418 is related to CVE-2020-11069, where referrer enforcement was previously introduced but became ineffective.