CVE-2026-47352

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47352
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47352.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47352
Aliases
Published
2026-06-09T10:53:05Z
Modified
2026-08-12T03:51:29Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TYPO3 CMS - Broken Access Control in Backend API
Details

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Database specific 
{
    "cna_assigner": "TYPO3",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47352.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "10.4.57"
                },
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.5.51"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.4.46"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
fd8745e46bb11773e85524b8ee9650dabe340713
Introduced
6d6bd23afff6a48ee3efeaa68eb829820397d6a1
Fixed
59bfeaaf0136dfe17011786ce825884e48bedc8d
Fixed
e16ec78165a7d60f09dcac04bfbb309409e174b3
Fixed
17a3b7830d5931725db5fdab0cfc76d479884c96
Fixed
bfe7c354168f467726020ed49299dd209a455719
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.4.31"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.3.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v13.*
v13.0.0
v13.1.0
v13.2.0
v13.2.1
v13.3.0
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.*
v14.0.0
v14.1.0
v14.2.0
v14.3.0
v14.3.1
v14.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47352.json"