Vulnerability · Published Sep 8, 2026 · Assigned by TYPO3

CVE-2026-85400TYPO3 CMS - Missing Authorization in lowlevel commands

High 7.5

In plain English

A high-severity missing authorization in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	14.2.0 – before 14.3.7

Weakness: CWE-862, CWE-266 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://news.typo3.com/security/advisory/typo3-core-sa-2026-023 vendor-advisory
Git commit of main branch patch
Git commit of 14.3 branch patch