CVE-2023-50461: TYPO3 Direct Mail Extension Auth Bypass Flaw

CVE-2023-50461 Overview

CVE-2023-50461 affects the direct_mail (Direct Mail) extension for TYPO3 through version 9.5.1. The Configuration backend module allows an authenticated backend user to write to arbitrary TSConfig pages for folders configured as Direct Mail. On TYPO3 10.4 and above, this enables Configuration Injection. On TYPO3 9.5 and below, it escalates to Arbitrary Code Execution. Exploitation requires a valid backend user account with access to the Direct Mail Configuration backend module. The issue is tracked under [CWE-863: Incorrect Authorization]. Details are published in the TYPO3 Security Advisory 2023-011.

Critical Impact

Authenticated backend users can inject arbitrary TSConfig, leading to configuration tampering or arbitrary code execution on legacy TYPO3 installations.

Affected Products

• TYPO3 direct_mail extension versions through 9.5.1
• TYPO3 CMS 9.5 and below (arbitrary code execution impact)
• TYPO3 CMS 10.4 and above (configuration injection impact)

Discovery Timeline

• 2026-09-14 - CVE-2023-50461 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-50461

Vulnerability Analysis

The direct_mail extension exposes a Configuration backend module intended to manage TSConfig settings for pages flagged as Direct Mail folders. The module fails to properly verify whether the authenticated user is authorized to write to the target page's TSConfig. As a result, any backend user with access to the Direct Mail Configuration module can modify TSConfig on pages that should be outside their permission scope.

TSConfig controls backend behavior, form defaults, and, in older TYPO3 versions, user function references that resolve to executable PHP. On TYPO3 10.4 and later, the impact is limited to configuration injection that can alter backend behavior for other users. On TYPO3 9.5 and earlier, the injected TSConfig can be leveraged to invoke arbitrary PHP callables, yielding remote code execution in the context of the web server.

Root Cause

The root cause is an authorization gap in the extension's Configuration module. The module accepts a page target parameter and writes TSConfig without enforcing per-page write permissions against the acting user. This maps to [CWE-863: Incorrect Authorization].

Attack Vector

An authenticated attacker with backend access to the Direct Mail Configuration module submits a request to the module supplying a page identifier for a folder marked as a Direct Mail folder. The module writes the attacker-controlled TSConfig payload to that page. Subsequent backend actions consume the injected TSConfig, delivering either configuration tampering or code execution depending on the TYPO3 core version. Refer to the TYPO3 Security Advisory 2023-011 for full technical context. No public proof-of-concept exploit code is available.

Detection Methods for CVE-2023-50461

Indicators of Compromise

• Unexpected modifications to pages.TSconfig fields on records flagged as Direct Mail folders
• Backend audit log entries showing writes to the Direct Mail Configuration module by low-privilege accounts
• New or altered userFunc or postUserFunc references appearing in TSConfig on legacy TYPO3 9.5 installations

Detection Strategies

• Review database change history for the pages table, focusing on TSconfig column diffs on Direct Mail folder records
• Correlate backend user sessions with Direct Mail Configuration module access events to identify unauthorized writes
• Alert on TSConfig content referencing PHP class or function callables that were not present in prior baselines

Monitoring Recommendations

• Enable and centrally forward TYPO3 backend sys_log and sys_history records to a SIEM for retention and correlation
• Monitor web server access logs for POST requests to Direct Mail module endpoints from non-administrator accounts
• Track backend user permission changes to detect attempts to gain access to the Direct Mail Configuration module

How to Mitigate CVE-2023-50461

Immediate Actions Required

• Upgrade the direct_mail extension to a fixed release published after version 9.5.1 as noted in the vendor advisory
• Restrict access to the Direct Mail Configuration backend module to trusted administrator accounts only
• Audit existing TSConfig on Direct Mail folder pages for unauthorized entries and revert any suspicious changes

Patch Information

Apply the fixed direct_mail extension version referenced in the TYPO3 Security Advisory 2023-011. Installations running TYPO3 9.5 or earlier should prioritize patching because the vulnerability enables arbitrary code execution on those releases. Installations on TYPO3 10.4 and later remain exposed to configuration injection until patched.

Workarounds

• Remove access to the Direct Mail Configuration module from all non-administrator backend user groups
• Temporarily disable the direct_mail extension in environments where a patched version cannot be deployed immediately
• Enforce least-privilege review on backend user groups to limit which accounts can reach Direct Mail folders

# Example: list backend groups with access to the Direct Mail module for review
# Run against the TYPO3 database and review results manually
SELECT uid, title, groupMods FROM be_groups WHERE groupMods LIKE '%DirectMailNavFrame%';