TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard

PKSA-745m-816f-bzfy CVE-2026-77132

Affected version: >=10.0.0,<10.4.60|>=11.0.0,<11.5.54|>=12.0.0,<12.4.49|>=13.0.0,<13.4.35|>=14.0.0,<14.3.7

Reported by:
FriendsOfPHP/security-advisories

[HIGH] TYPO3 CMS - Broken Access Control in Backend and Install Tool

PKSA-nmd9-kc7m-nsvr CVE-2026-19418 GHSA-68jx-f42c-7599

Affected version: >=13.0.0,<13.4.34

Reported by:
GitHub

[MEDIUM] TYPO3 CMS has Broken Access Control in Backend API

PKSA-gksc-phy8-f181 CVE-2026-47352 GHSA-2j54-93q2-3hjq

Affected version: >=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57

Reported by:
GitHub

[MEDIUM] TYPO3 CMS: Broken Access Control in Media Module

PKSA-4mhm-w6hx-yhcy CVE-2026-47351 GHSA-q93m-25xv-94hh

Affected version: >=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57

Reported by:
GitHub