medium5.3
CVE-2026-47350
Backend users were able to move records to a different page without having edit permissions on the source page.
Impact
Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | typo3/cms-core | >= 13.0.0, < 13.4.31 | 13.4.31 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-qcmw-6rm2-5x78
- https://github.com/TYPO3/typo3/security/advisories/GHSA-qcmw-6rm2-5x78
- https://nvd.nist.gov/vuln/detail/CVE-2026-47350
- https://github.com/TYPO3/typo3/commit/195356996a60e40aeb2cd3e45a5f5c8940d5e116
- https://github.com/TYPO3/typo3/commit/c9898d2e67608eda78f8bd1f06ee9cf05a872a56
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47350.yaml
- https://typo3.org/security/advisory/typo3-core-sa-2026-012