5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47352

CVE-2026-47352: TYPO3 CMS - Broken Access Control in Backend API

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47352

CVE-2026-47352:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-core	composer	< 10.4.57	10.4.57
typo3/cms-core	composer	>= 11.0.0, < 11.5.51	11.5.51
typo3/cms-core	composer	>= 12.0.0, < 12.4.46	12.4.46
typo3/cms-core	composer	>= 13.0.0, < 13.4.31	13.4.31
typo3/cms-core	composer	>= 14.0.0, < 14.3.3	14.3.3
typo3/cms-backend	composer	< 10.4.57	10.4.57
typo3/cms-backend	composer	>= 11.0.0, < 11.5.51	11.5.51
typo3/cms-backend	composer	>= 12.0.0, < 12.4.46	12.4.46
typo3/cms-backend	composer	>= 13.0.0, < 13.4.31	13.4.31
typo3/cms-backend	composer	>= 14.0.0, < 14.3.3	14.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several backend API controllers within TYPO3 CMS that failed to perform adequate permission checks before providing access to file metadata. Authenticated backend users could exploit this by sending crafted requests to these API endpoints to retrieve information about files and folders they were not authorized to access. The analysis of the provided patches confirms that the functions process in ImageProcessController, resourceAction in LinkController, and gatherInformationAction in ResourceController were all missing crucial checkActionPermission('read') calls. The absence of these checks meant that any authenticated user could potentially enumerate and view metadata of files stored within the CMS, regardless of their assigned permissions or file mount restrictions. The patches rectify this by adding the necessary permission checks, thus enforcing the intended access control policy.

Vulnerable functions

TYPO3\CMS\Backend\Controller\File\ImageProcessController::process

typo3/sysext/backend/Classes/Controller/File/ImageProcessController.php

The `process` function in `ImageProcessController` was vulnerable to a broken access control vulnerability. It processed an image based on an ID from the request without verifying if the authenticated backend user had read permissions for the original file. This allowed users to access file metadata for files outside their permitted file mounts or storages. The patch adds a `checkActionPermission('read')` check on the original file to ensure the user has the necessary permissions.

TYPO3\CMS\Backend\Controller\LinkController::resourceAction

typo3/sysext/backend/Classes/Controller/LinkController.php

The `resourceAction` function in `LinkController` was vulnerable because it did not properly check for read permissions on file resources. An authenticated backend user could craft a request to this action with a file identifier and retrieve information about the file, even if they did not have explicit read permissions. This could lead to information disclosure about files outside the user's allowed scope. The patch mitigates this by adding a `checkActionPermission('read')` call for file resources.

TYPO3\CMS\Backend\Controller\Resource\ResourceController::gatherInformationAction

typo3/sysext/backend/Classes/Controller/Resource/ResourceController.php

The `gatherInformationAction` in `ResourceController` was susceptible to a broken access control issue. This function is responsible for gathering and returning information about a given resource. Before the patch, it did not verify if the user had read permissions on the requested resource. This allowed an authenticated backend user to obtain metadata about any file or folder by providing its identifier, bypassing any access restrictions. The fix introduces a `checkActionPermission('read')` check, ensuring that information is only returned for resources the user is permitted to read.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.