CVE-2026-47343: TYPO3 CMS Auth Bypass Vulnerability

CVE-2026-47343 Overview

CVE-2026-47343 is a missing authorization vulnerability [CWE-862] in TYPO3 CMS. Non-privileged backend users with file mount access can perform destructive write operations on folders that represent the root of an active file mount. The flaw allows authenticated low-privilege users to move, delete, or rename file mount root folders without proper authorization checks. TYPO3 addressed the issue in security advisory SA-2026-007 by introducing an isFileMountFolder() check inside ResourceStorage.

Critical Impact
Authenticated backend users can destroy, rename, or relocate file mount root folders, disrupting content storage and breaking site functionality for all users sharing the mount.

Affected Products

TYPO3 CMS versions prior to 10.4.57
TYPO3 CMS versions 11.0.0 through 11.5.50 and 12.0.0 through 12.4.45
TYPO3 CMS versions 13.0.0 through 13.4.30 and 14.0.0 through 14.3.2

Discovery Timeline

2026-06-09 - CVE-2026-47343 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47343

Vulnerability Analysis

The vulnerability resides in the TYPO3 file abstraction layer, specifically in typo3/sysext/core/Classes/Resource/ResourceStorage.php. TYPO3 file mounts grant backend users access to specific directories within a storage. Users should be permitted to operate on content inside the mount, but not on the mount root itself. The pre-patch code only verified that a target folder was within a registered mount. It did not differentiate between the mount root folder and its children. As a result, users could invoke move, delete, and rename operations against the mount root, with consequences propagating to every other user sharing that mount.

Root Cause

The root cause is a missing authorization check [CWE-862]. ResourceStorage lacked a function to identify whether a given Folder object represented the root of an active file mount. Authorization logic for destructive operations relied solely on mount-inclusion checks, leaving the boundary case of the mount root itself unguarded.

Attack Vector

An attacker requires valid backend credentials with file mount permissions. Using the standard TYPO3 file list module, the attacker selects a mount root folder and triggers a rename, move, or delete action. The backend dispatches the request through ResourceStorage, which previously approved the operation without verifying mount-root status. Network access to the backend interface is sufficient. No user interaction from administrators is required.

php

// Patch: introduces isFileMountFolder() in ResourceStorage.php
// Source: https://github.com/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798
        return $this->fileMounts;
    }

+    public function isFileMountFolder(Folder $folder): bool
+    {
+        foreach ($this->fileMounts as $mount) {
+            $rootLevelFolder = $mount['folder'] ?? null;
+            if ($rootLevelFolder instanceof Folder && $rootLevelFolder->getCombinedIdentifier() === $folder->getCombinedIdentifier()) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    /**
     * Checks if the given subject is within one of the registered user
     * file mounts. If not, working with the file is not permitted for the user.

The patched method compares the combined identifier of the target folder against every mount root. Destructive operations now reject targets that match a mount root. See the TYPO3 Security Advisory SA-2026-007 and the upstream commits 504e724 and ac4125a for the full fix.

Detection Methods for CVE-2026-47343

Indicators of Compromise

Backend audit log entries (sys_log) showing rename, move, or delete actions on folders that match configured file mount root paths in sys_filemounts.
Unexpected disappearance or renaming of top-level directories in storages such as fileadmin/ that are configured as file mounts.
Backend activity from non-administrator users targeting folders at the root of their assigned mounts.

Detection Strategies

Query the sys_log table for tablename = 'sys_file' events where the affected path equals a row in sys_filemounts.path.
Correlate filesystem change events from the underlying storage with TYPO3 backend session activity to attribute folder operations to specific users.
Alert on any backend user without administrator privileges who triggers folder rename or delete operations affecting more than one downstream user.

Monitoring Recommendations

Enable verbose backend logging for file operations and forward logs to a centralized analytics platform.
Monitor TYPO3 storage directories with file integrity monitoring focused on folders referenced by sys_filemounts.
Review backend user group permissions periodically to confirm only intended accounts hold file mount write access.

How to Mitigate CVE-2026-47343

Immediate Actions Required

Upgrade TYPO3 CMS to a fixed release: 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 or later.
Audit be_users and be_groups for accounts that hold file mount write permissions and remove unnecessary access.
Review sys_log history for prior destructive operations against mount root folders and validate storage integrity from backups if anomalies appear.

Patch Information

TYPO3 published the fix in security advisory SA-2026-007. Upstream commits 504e724 and ac4125a add the isFileMountFolder() helper and enforce a denial of move, delete, and rename actions when the target folder equals a mount root. Apply the fix via Composer using composer update typo3/cms-core or by upgrading the TYPO3 source archive.

Workarounds

If immediate patching is not possible, revoke file mount write permissions from non-administrator backend groups until the upgrade completes.
Restrict backend access to the TYPO3 install with IP allowlisting or VPN to reduce the population of users who could exploit the flaw.
Take regular backups of storages backing file mounts so that destructive actions can be reversed quickly.

bash

# Upgrade TYPO3 core to a patched release using Composer
composer require typo3/cms-core:"^13.4.31" --update-with-dependencies
# Verify the installed version
./vendor/bin/typo3 --version