CVE-2026-6553

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6553
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6553.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6553
Aliases
Published
2026-04-21T10:04:02Z
Modified
2026-10-22T02:30:37Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
TYPO3 CMS Stores Cleartext Password in User Settings Module
Details

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

Database specific 
{
    "cna_assigner":  "TYPO3",
    "cwe_ids":  [
        "CWE-312"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6553.json"
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
cfda1147fba7bb5bbe30cf5aedd3277a0a329b3e
Fixed
5b0ba8a1eca8b2ccfa39320a2de66676a2eea151
Fixed
9a6e913f70767f63b322ae3e2d2f4e302624c291
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "14.2.0"
                },
                {
                    "fixed":  "14.3.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "9a6e913f70767f63b322ae3e2d2f4e302624c291"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

14.*
14.2.0
v14.*
v14.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6553.json"