Vulnerability · Published Sep 8, 2026 · Assigned by TYPO3

CVE-2026-77132TYPO3 CMS - Information Disclosure via Backend Localization Wizard

Medium 5.3

In plain English

A medium-severity missing authorization in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	10.0.0 – before 10.4.6011.0.0 – before 11.5.5412.0.0 – before 12.4.4913.0.0 – before 13.4.3514.0.0 – before 14.3.7

Weakness: CWE-862, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://news.typo3.com/security/advisory/typo3-core-sa-2026-022 vendor-advisory
Git commit of main branch patch
Git commit of 14.3 branch patch
Git commit of 13.4 branch patch