CVE-2026-19418: TYPO3 CMS CSRF Vulnerability

CVE-2026-19418 Overview

CVE-2026-19418 is a security misconfiguration in TYPO3 CMS where the referrer enforcement introduced by TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective starting in TYPO3 v13.0. When TYPO3 began serving the backend and Install Tool applications from the site's main entry script rather than the dedicated typo3/ directory, the referrer check began comparing requests against the site root instead of the backend directory. As a result, any script executing on one of the TYPO3 instance's own domains, including frontend pages, can invoke backend routes and Install Tool endpoints. The flaw is tracked under [CWE-346] (Origin Validation Error) and affects TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5.

Critical Impact
An attacker able to execute JavaScript on any same-domain page can issue Fetch/XHR calls to backend and Install Tool endpoints with the privileges of an authenticated victim's session.

Affected Products

TYPO3 CMS 13.0.0 through 13.4.33
TYPO3 CMS 14.0.0 through 14.3.5
TYPO3 backend and Install Tool components using the RouteDispatcher referrer enforcement path

Discovery Timeline

2026-08-11 - CVE-2026-19418 published to NVD
2026-08-11 - Last updated in NVD database
Advisory - TYPO3 published security advisory TYPO3-CORE-SA-2026-021

Technical Details for CVE-2026-19418

Vulnerability Analysis

The vulnerability is an origin validation error in the TYPO3 backend request pipeline. TYPO3 uses a referrer enforcement mechanism to ensure that state-changing backend requests originate from the backend UI itself. In versions prior to 13.0, backend applications were served from the typo3/ directory, so referrer checks correctly compared requests against that directory.

Starting with TYPO3 v13.0, the backend and Install Tool are served from the site's main entry script. The referrer enforcement continued to compare against the entry script's directory, which is now the site root. Consequently, any request whose Referer header points to a page hosted on the same domain (for example, a rendered frontend page) is treated as originating from the backend.

This reduces the referrer check from a backend-origin gate to a same-host gate, defeating the original mitigation from TYPO3-CORE-SA-2020-006.

Root Cause

The root cause is an incorrect assumption about the location of the backend entry point. The core ReferrerEnforcer compares the referrer against the directory of the entry script. When the backend moved into the site root, the comparison lost specificity. The fix introduces a backend-specific ReferrerEnforcer that treats a referrer as same-origin only if it points into the backend entry point path such as https://example.org/typo3/, not merely to the same host.

Attack Vector

Exploitation requires an attacker to execute JavaScript on the same domain as the TYPO3 instance, typically through a cross-site scripting (XSS) flaw in a frontend page, plugin, or user-generated content. The attacker then uses fetch() or XMLHttpRequest from that origin to invoke backend routes or Install Tool endpoints. Because the victim is an authenticated backend user, the browser attaches the session cookie and the forged request executes with the victim's privileges. User interaction is required because a backend user must be authenticated and browsing an attacker-controlled page.

php

// Patch: typo3/sysext/backend/Classes/Http/RouteDispatcher.php
 use Psr\EventDispatcher\EventDispatcherInterface;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Backend\Http\Security\ReferrerEnforcer;
 use TYPO3\CMS\Backend\Routing\Exception\InvalidRequestTokenException;
 use TYPO3\CMS\Backend\Routing\Exception\MissingRequestTokenException;
 use TYPO3\CMS\Backend\Routing\Route;

// New backend-specific ReferrerEnforcer
+namespace TYPO3\CMS\Backend\Http\Security;
+
+use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Core\Http\Security\ReferrerEnforcer as CoreReferrerEnforcer;
+use TYPO3\CMS\Core\Routing\BackendEntryPointResolver;
+
+/**
+ * Treats a referrer as same-origin only if it points into the backend entry point
+ * (e.g. `https://example.org/typo3/`) - and not merely to the same host.
+ *
+ * @internal
+ */
+readonly class ReferrerEnforcer extends CoreReferrerEnforcer

Source: TYPO3 commit 4a75e862

Detection Methods for CVE-2026-19418

Indicators of Compromise

Backend or Install Tool requests whose Referer header points to a frontend URL on the same TYPO3 domain rather than to /typo3/.
Unexpected POST or state-changing requests to backend module routes originating from an authenticated backend session immediately after the user visited a frontend page.
Web server or application logs showing Install Tool endpoint access with a Referer outside of the /typo3/ path.

Detection Strategies

Inspect access logs for backend route hits (paths dispatched through RouteDispatcher) correlated with frontend Referer values.
Monitor for XSS indicators in frontend content, plugin output, and user-submitted fields that could serve as the injection vector for the forgery step.
Alert on any request to /typo3/install.php or Install Tool endpoints that lacks a Referer within the backend entry point path.

Monitoring Recommendations

Enable verbose request logging on the TYPO3 web tier and forward it to a centralized analytics platform to correlate frontend XSS activity with backend route access.
Track backend session activity for privileged users and flag simultaneous frontend page loads and backend state changes from the same client.
Review TYPO3 sys_log entries for unexpected administrative actions performed under a legitimate user's account.

How to Mitigate CVE-2026-19418

Immediate Actions Required

Upgrade TYPO3 CMS to a fixed release in the 13.4.34 or 14.3.6 line (or later), as directed by TYPO3-CORE-SA-2026-021.
Audit installed extensions and frontend templates for XSS vulnerabilities that could be chained with this flaw.
Restrict backend access at the network layer where feasible, so backend endpoints are not reachable from arbitrary frontend contexts.

Patch Information

The fix introduces a backend-specific ReferrerEnforcer in typo3/sysext/backend/Classes/Http/Security/ReferrerEnforcer.php that extends the core enforcer and uses BackendEntryPointResolver to validate that the referrer points into the backend entry point (for example /typo3/), not just the same host. The updated RouteDispatcher uses this backend enforcer. See the upstream commits: 4a75e862, a0e8ee06, and ae0abd32.

Workarounds

If patching cannot occur immediately, serve the TYPO3 backend from a distinct hostname (for example backend.example.org) so cross-origin protections apply between frontend and backend contexts.
Enforce a strict Content Security Policy (CSP) on frontend pages to limit the impact of XSS that could be used to launch Fetch/XHR forgery.
Require re-authentication or step-up for sensitive backend and Install Tool actions until the patch is applied.

bash

# Verify installed TYPO3 version and upgrade via Composer
php vendor/bin/typo3 --version
composer require typo3/cms-core:"^13.4.34" --update-with-all-dependencies
# Or for the 14.x branch
composer require typo3/cms-core:"^14.3.6" --update-with-all-dependencies

# After upgrade, flush caches
php vendor/bin/typo3 cache:flush