CVE-2026-19418

{
  "id": "CVE-2026-19418",
  "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
  "published": "2026-08-11T08:17:20.533",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.\n\nWhether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.\n\nAttackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5."
    },
    {
      "lang": "es",
      "value": "La aplicación del referente introducida con TYPO3-CORE-SA-2020-006 (CVE-2020-11069) se volvió ineficaz en TYPO3 v13.0, donde TYPO3 CMS comenzó a servir las aplicaciones del backend y del Install Tool desde el script de entrada principal del sitio en lugar del directorio dedicado typo3/.\n\nSi una solicitud se originaba desde el backend o el propio Install Tool se determinaba comparando el referente con el directorio del script de entrada, que desde entonces es la raíz del sitio. Como consecuencia, las solicitudes originadas desde cualquier script ejecutándose en uno de los propios dominios de la instancia de TYPO3, como una página de frontend, eran aceptadas por las rutas del backend y los puntos finales del Install Tool.\n\nAtacantes capaces de ejecutar JavaScript en uno de esos dominios, por ejemplo, explotando una vulnerabilidad de cross-site scripting, podían invocar estos puntos finales a través de Fetch/XHR con los privilegios de la sesión de usuario de una víctima autenticada. Este problema afecta a las versiones de TYPO3 CMS 13.0.0-13.4.33 y 14.0.0-14.3.5."
    }
  ],
  "affected": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "affectedData": [
        {
          "vendor": "TYPO3",
          "product": "TYPO3 CMS",
          "defaultStatus": "unaffected",
          "collectionURL": "https://packagist.org",
          "packageName": "typo3/cms-backend",
          "modules": [
            "Backend",
            "Install"
          ],
          "repo": "https://github.com/TYPO3/typo3",
          "versions": [
            {
              "version": "13.0.0",
              "lessThan": "13.4.34",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.0.0",
              "lessThan": "14.3.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "TYPO3",
          "product": "TYPO3 CMS",
          "defaultStatus": "unaffected",
          "collectionURL": "https://packagist.org",
          "packageName": "typo3/cms-core",
          "modules": [
            "Backend",
            "Install"
          ],
          "repo": "https://github.com/TYPO3/typo3",
          "versions": [
            {
              "version": "13.0.0",
              "lessThan": "13.4.34",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.0.0",
              "lessThan": "14.3.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "TYPO3",
          "product": "TYPO3 CMS",
          "defaultStatus": "unaffected",
          "collectionURL": "https://packagist.org",
          "packageName": "typo3/cms-install",
          "modules": [
            "Backend",
            "Install"
          ],
          "repo": "https://github.com/TYPO3/typo3",
          "versions": [
            {
              "version": "14.0.0",
              "lessThan": "14.3.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:20:52.512047Z",
          "id": "CVE-2026-19418",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2020-006",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-021",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    }
  ]
}