CVE-2026-6553

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6553
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6553.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6553
Aliases
Published
2026-04-21T10:04:02.525Z
Modified
2026-08-07T11:51:31.522092103Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
TYPO3 CMS Stores Cleartext Password in User Settings Module
Details

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and usersettings fields of the beusers database table. This issue affects TYPO3 CMS version 14.2.0.

Database specific 
{
    "cna_assigner": "TYPO3",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6553.json",
    "cwe_ids": [
        "CWE-312"
    ]
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
cfda1147fba7bb5bbe30cf5aedd3277a0a329b3e
Fixed
5b0ba8a1eca8b2ccfa39320a2de66676a2eea151
Database specific 
{
    "extracted_events": [
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.3.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

14.*
14.2.0
v14.*
v14.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6553.json"