CVE-2026-47350

Medium

Description

Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

SeverityMedium

CVSS5.3

Exploit probability—

ProductTypo3/cms-core

PublishedJun 9, 2026

First seenJun 9, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

typo3/cms-core13.4.31, 14.3.3 or later

Patches

github.com/TYPO3/typo3/commit/c9898d2e67608eda78f8bd1f06ee9cf05a872a56
github.com/TYPO3/typo3/commit/195356996a60e40aeb2cd3e45a5f5c8940d5e116

Vendor advisories

typo3.org/security/advisory/typo3-core-sa-2026-012

Affected products

Product	Affected versions	Fixed in
typo3/cms-corePackagist	13.0.0 ≤ v < 13.4.31, 14.0.0 ≤ v < 14.3.3	13.4.31, 14.3.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.