security Update dependency typo3/cms-backend to v14 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
typo3/cms-backend (source)	^12.0 || ^13.0 → ^14.0

---

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

CVE-2025-59020 / GHSA-5j7q-wmh7-cqhg

More information

Details

Problem

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.

Solution

Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

Credits

Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.

References

• TYPO3-CORE-SA-2026-001

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg
• https://nvd.nist.gov/vuln/detail/CVE-2025-59020
• https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b
• https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118
• https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232
• https://typo3.org/security/advisory/typo3-core-sa-2026-001
• https://github.com/advisories/GHSA-5j7q-wmh7-cqhg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

TYPO3 CMS: Broken Access Control in Media Module

CVE-2026-47351 / GHSA-q93m-25xv-94hh

More information

Details

Problem

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.

Resources

• TYPO3-CORE-SA-2026-014

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/TYPO3/typo3/security/advisories/GHSA-q93m-25xv-94hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-47351
• https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3
• https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47351.yaml
• https://typo3.org/security/advisory/typo3-core-sa-2026-014
• https://github.com/advisories/GHSA-q93m-25xv-94hh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

TYPO3 CMS has Broken Access Control in Backend API

CVE-2026-47352 / GHSA-2j54-93q2-3hjq

More information

Details

Problem

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

• TYPO3-CORE-SA-2026-015

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/TYPO3/typo3/security/advisories/GHSA-2j54-93q2-3hjq
• https://nvd.nist.gov/vuln/detail/CVE-2026-47352
• https://github.com/TYPO3/typo3/commit/17a3b7830d5931725db5fdab0cfc76d479884c96
• https://github.com/TYPO3/typo3/commit/bfe7c354168f467726020ed49299dd209a455719
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47352.yaml
• https://typo3.org/security/advisory/typo3-core-sa-2026-015
• https://github.com/advisories/GHSA-2j54-93q2-3hjq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

CVE-2025-59020 / GHSA-5j7q-wmh7-cqhg

More information

Details

Problem

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.

Solution

Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

Credits

Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.

References

• TYPO3-CORE-SA-2026-001

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg
• https://nvd.nist.gov/vuln/detail/CVE-2025-59020
• https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b
• https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118
• https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232
• https://github.com/TYPO3/typo3
• https://typo3.org/security/advisory/typo3-core-sa-2026-001

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

TYPO3-CMS/backend (typo3/cms-backend)

v14.0.0

Compare Source

v13.4.31

Compare Source

v13.4.30

Compare Source

v13.4.29

Compare Source

v13.4.28

Compare Source

v13.4.27

Compare Source

v13.4.26

Compare Source

v13.4.25

Compare Source

v13.4.24

Compare Source

v13.4.23

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update typo3/cms-backend:14.0.0 --with-dependencies --ignore-platform-req ext-* --ignore-platform-req lib-* --ignore-platform-req php --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency typo3/cms-core is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires typo3/cms-backend ^14.0, found typo3/cms-backend[v14.0.0, ..., v14.3.1] but these were not loaded, because they are affected by security advisories ("PKSA-j4dd-3nrn-j8w4", "PKSA-54yn-xn5g-k3j9"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 2
    - typo3/cms-dashboard is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-dashboard v13.4.22 requires typo3/cms-backend 13.4.22 -> found typo3/cms-backend[v13.4.22] but it conflicts with your root composer.json require (^14.0).
  Problem 3
    - helhum/typo3-console is locked to version v8.3.1 and an update of this package was not requested.
    - helhum/typo3-console v8.3.1 requires typo3/cms-backend ^11.5.26 || ^12.4.18 || ^13.1 || ^14.0 -> found typo3/cms-backend[v11.5.26, ..., v11.5.41, v12.4.18, ..., v12.4.45, v13.1.0, ..., v13.4.29, v14.0.0, ..., v14.3.1] but these were not loaded, because they are affected by security advisories ("PKSA-j4dd-3nrn-j8w4", "PKSA-54yn-xn5g-k3j9", "PKSA-27mn-p368-8rxc", "PKSA-npmp-rd1w-2fyt", "PKSA-957f-x856-svyv", "PKSA-7w9w-389g-6rb9", "PKSA-9vjc-5m3y-9mrq", "PKSA-4w8t-ddwx-n1z6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 4
    - typo3/cms-base-distribution is locked to version v13.4.1 and an update of this package was not requested.
    - typo3/cms-base-distribution v13.4.1 requires typo3/cms-backend ^13.4 -> found typo3/cms-backend[v13.4.0, ..., v13.4.29] but it conflicts with your root composer.json require (^14.0).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}