CVE-2026-85400

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85400
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85400.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85400
Published
2026-09-08T09:18:40Z
Modified
2026-09-14T03:46:07Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
TYPO3 CMS - Missing Authorization in lowlevel commands
Details

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

Database specific 
{
    "cna_assigner":  "TYPO3",
    "cwe_ids":  [
        "CWE-266",
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85400.json"
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
cfda1147fba7bb5bbe30cf5aedd3277a0a329b3e
Fixed
b8abe36978c63a0625aee70df078895216e7ee27
Fixed
e15da7ba0218532240578b471152f76c13cb4154
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "14.2.0"
        },
        {
            "fixed":  "14.3.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v14.*
v14.2.0
v14.3.0
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.3.5
v14.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85400.json"