--- title: "TYPO3-EXT-SA-2014-005: Access Bypass in extensions \"Yet Another Gallery\" (yag) and \"Tools for Extbase development\" (pt_extbase)" url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2014-005" description: "It has been discovered that the extensions \"Yet Another Gallery\" (yag) and \"Tools for Extbase development\" (pt_extbase) are susceptible to Access Bypass" image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - TYPO3 Extensions --- # TYPO3-EXT-SA-2014-005: Access Bypass in extensions "Yet Another Gallery" (yag) and "Tools for Extbase development" (pt_extbase) - Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions) TYPO3-EXT-SA-2014-005: Access Bypass in extensions "Yet Another Gallery" (yag) and "Tools for Extbase development" (pt\_extbase) ================================================================================================================================ 12 February 2014 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the extensions "Yet Another Gallery" (yag) and "Tools for Extbase development" (pt\_extbase) are susceptible to Access Bypass - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) **Release Date:** February 12, 2014 **Component Type:** Third party extension. This extension is not a part of the TYPO3 default installation. **Affected Versions:** yag: Version 3.0.0 and below, pt\_extbase: Version 1.5.0 and below **Vulnerability Type:** Access Bypass **Severity:** High **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **CVE:** CVE-2014-6289 **Bulletin update:** September 18, 2014 (added CVE) **Problem Description:** The extension pt\_extbase comes with an Ajax dispatcher for Extbase. Using this dispatcher it is possible to call every action in every controller of every Extbase extension installed on the system. The dispatcher failes to do access checks, thus it is possible to bypass access checks for Extbase Backend Modules like the backend user administration module. The extension yag also delivered an Ajax dispatcher, which was unused but vulnerable. **Important Note:** The unused Ajax Dispatcher code in extension yag has been removed. If any other installed extensions made use of this dispatcher, it will stop working. Additionally the Ajax dispatcher in pt\_extbase was modified to do access checks. Third party extensions using this dispatcher need to be added to the list of allowed actions. **Solution:** Updated versions 3.0.1 and 1.5.1 are available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/download/yag/3.0.1/t3x/](http://typo3.org/extensions/repository/download/yag/3.0.1/t3x/ "Opens external link in new window") and [http://typo3.org/extensions/repository/download/pt\_extbase/1.5.1/t3x/](http://typo3.org/extensions/repository/download/pt_extbase/1.5.1/t3x/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible. **Credits:** Credits go to Andrea Schmuttermair who discovered and reported this issue. **General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png) About the Author [Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) [More posts by this author](https://news.typo3.com/article/author/helmut-hummel)