CVE-2026-47349: TYPO3 CMS Auth Bypass Vulnerability

CVE-2026-47349 Overview

CVE-2026-47349 is a missing authorization vulnerability [CWE-862] in the TYPO3 CMS Recycler module. Backend users with access to the Recycler could restore soft-deleted records on pages or tables they were not authorized to modify. The DataHandler component failed to validate modify permissions before performing record undelete operations.

The issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.51, 12.0.0 through 12.4.46, 13.0.0 through 13.4.31, and 14.0.0 through 14.3.3. Exploitation requires authenticated backend access with Recycler privileges.

Critical Impact
An authenticated backend user with Recycler access can bypass table and page permission checks to restore records they should not be able to modify, undermining the TYPO3 access control model.

Affected Products

TYPO3 CMS versions prior to 10.4.57
TYPO3 CMS 11.0.0 through 11.5.51, and 12.0.0 through 12.4.46
TYPO3 CMS 13.0.0 through 13.4.31, and 14.0.0 through 14.3.3

Discovery Timeline

2026-06-09 - CVE CVE-2026-47349 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47349

Vulnerability Analysis

The vulnerability resides in the record undelete logic of TYPO3's DataHandler class. When a backend user invoked the Recycler module to restore a soft-deleted record, the handler retrieved the record's schema and toggled the soft-delete field without verifying that the current user had modify access to the target table. Permission checks normally enforced on insert, update, and delete operations were absent from the undelete code path.

This is a broken access control flaw classified as [CWE-862] Missing Authorization. The attack surface is the TYPO3 backend, which is reachable over the network and requires low privileges. Successful exploitation produces a low-confidentiality and low-integrity impact, since restored records become visible and editable through the standard backend workflows.

Root Cause

The undeleteRecord flow in typo3/sysext/core/Classes/DataHandling/DataHandler.php resolved the soft-delete and updated-at fields directly from the TCA schema and proceeded to restore the record. There was no call to checkModifyAccessList($table) to confirm the backend user was permitted to modify the target table.

Attack Vector

An authenticated backend user with access to the Recycler module submits an undelete request targeting a record in a table they are not authorized to modify. The handler resolves the schema, clears the soft-delete flag, and persists the record without consulting the user's modify access list. The attacker effectively reintroduces content that bypasses page or table-level access policies.

php

        $deleteField = $schema->hasCapability(TcaSchemaCapability::SoftDelete) ? $schema->getCapability(TcaSchemaCapability::SoftDelete)->getFieldName() : '';
        $timestampField = $schema->hasCapability(TcaSchemaCapability::UpdatedAt) ? $schema->getCapability(TcaSchemaCapability::UpdatedAt)->getFieldName() : '';

+        // Exit if the current user does not have permission to modify the table
+        if (!$this->checkModifyAccessList($table)) {
+            $this->log($table, 0, SystemLogDatabaseAction::DELETE, null, SystemLogErrorClassification::USER_ERROR, 'Cannot restore "{table}:{uid}" without permission', null, ['table' => $table, 'uid' => $uid]);
+            return;
+        }
+
        if ($record === null
            || $deleteField === ''
            || !isset($record[$deleteField])

Source: TYPO3 security patch commit 92f08d89. The added checkModifyAccessList($table) call enforces table-level authorization before the undelete proceeds and logs a USER_ERROR entry when access is denied.

Detection Methods for CVE-2026-47349

Indicators of Compromise

Backend log entries showing record restorations performed by users whose group permissions do not include modify access to the target table.
sys_log rows referencing the Recycler module followed by reappearance of previously soft-deleted records on restricted pages.
Unexpected changes to the deleted and updated-at fields on TCA-managed tables outside normal editorial workflows.

Detection Strategies

Audit TYPO3 sys_log for SystemLogDatabaseAction::DELETE and undelete operations and correlate the executing user with their assigned be_groups modify permissions.
Review Recycler usage history and flag restorations targeting tables or page trees outside the user's normal scope.
After patching, monitor for Cannot restore "{table}:{uid}" without permission log entries that indicate blocked attempts.

Monitoring Recommendations

Forward TYPO3 backend and sys_log events to a centralized logging or SIEM platform for retention and correlation.
Alert on Recycler activity from low-privilege backend accounts, especially restorations of records under access-restricted page branches.
Track changes to TCA tables containing sensitive content, such as pages, tt_content, and fe_users.

How to Mitigate CVE-2026-47349

Immediate Actions Required

Upgrade TYPO3 CMS to 10.4.57, 11.5.52, 12.4.47, 13.4.32, or 14.3.4 or later, depending on the deployed branch.
Restrict access to the Recycler module to trusted backend users while patches are being deployed.
Review backend user and group permissions to ensure Recycler access is limited to those who require it.

Patch Information

The fix adds a checkModifyAccessList($table) permission check to the record undelete code path in DataHandler.php. See the TYPO3 Security Advisory TYPO3-CORE-SA-2026-011, along with the upstream commits 92f08d89 and 9f17a307.

Workarounds

Remove the Recycler module from backend user groups that do not require it through the backend module access configuration.
Reduce the number of backend accounts with broad table modify rights to limit the blast radius of misuse.
Increase audit logging retention and review Recycler activity until the patched release is in production.

bash

# Update TYPO3 CMS via Composer to a fixed release
composer require typo3/cms-core:^13.4.32 --update-with-all-dependencies
# Verify installed version
./vendor/bin/typo3 --version