Skip to main navigation Skip to main content Skip to page footer
Newsletter Sign-Up Follow Us

TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands

A laptop screen displaying a list of security advisories

It has been discovered that TYPO3 CMS is susceptible to unauthorized modification of system-wide configuration.

Problem Description

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service.

Exploiting this vulnerability requires an administrator-level backend user account.

Solution

Update to TYPO3 version 14.3.7 LTS that fixes the problem described.

Existing scheduler tasks which are configured to execute one of the mentioned configuration:* commands no longer work. Use alternative execution methods to perform scheduled configuration updates, e.g. by implementing custom cronjobs.

Credits

Thanks to Tharsanan Kurukulasingam for reporting this issue, and to TYPO3 security member Elias Häußler for fixing it.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.

General Note

All security-related code changes are tagged so you can easily look them up in our review system.