7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6553

CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6553

CVE-2026-6553:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-backend	composer	= 14.2.0	14.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, involves the incorrect storage of cleartext passwords in the TYPO3 CMS backend user settings. The provided commit 9a6e913f70767f63b322ae3e2d2f4e302624c291 directly addresses this issue. The analysis of the patch reveals that the SetupModuleController was the component responsible for this flawed behavior. Specifically, the storeIncomingData method within this controller was modified to prevent the mixing of sensitive user data with user interface settings. The original code took all POST data from the user settings form and processed it together, leading to password fields being saved into the serialized uc (user configuration) array. The patch introduces a separation of concerns by creating distinct partitions for user data (be_users) and user settings (user_settings) and adding a denylist for sensitive fields. This ensures that fields like 'password' are no longer persisted in the user settings columns. The addition of a database migration script (UserSettingsScrubbingMigration) to clean up existing incorrectly stored passwords further confirms that the storeIncomingData function was the entry point for this vulnerability. Therefore, this function is the primary runtime indicator when the vulnerability is triggered.

Vulnerable functions

TYPO3\CMS\Backend\Controller\SetupModuleController::storeIncomingData

typo3/sysext/backend/Classes/Controller/SetupModuleController.php

The vulnerability lies in the `storeIncomingData` function within the `SetupModuleController`. Before the patch, this function processed all submitted user data from the settings module as a single flat array. It failed to differentiate between sensitive user account fields (like 'password') and user interface settings. As a result, when a user updated their settings, including their password, the function would incorrectly save the cleartext password into the `uc` and `user_settings` fields of the `be_users` database table, which are intended for storing serialized user preferences, not credentials. The patch rectifies this by partitioning the incoming data into 'be_users' and 'user_settings' submissions and explicitly disallowing sensitive fields from being saved in the user settings.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.