CVE-2026-47352: TYPO3 CMS Information Disclosure Flaw

CVE-2026-47352 Overview

CVE-2026-47352 is a missing authorization vulnerability [CWE-862] in TYPO3 CMS. Authenticated backend users can retrieve file metadata via several Backend API routes without proper permission checks. The flaw allows access to files outside the user's permitted file mounts or storages, breaking the access control boundary that segregates editors and limits file visibility within multi-tenant or role-based TYPO3 deployments.

The issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31, and 14.0.0-14.3.3. Exploitation requires authenticated backend access but no user interaction.

Critical Impact
Authenticated backend users can enumerate and read metadata for files stored in storages or file mounts outside their assigned permissions, leading to information disclosure.

Affected Products

TYPO3 CMS versions prior to 10.4.57
TYPO3 CMS 11.0.0 through 11.5.51, 12.0.0 through 12.4.46
TYPO3 CMS 13.0.0 through 13.4.31 and 14.0.0 through 14.3.3

Discovery Timeline

2026-06-09 - CVE-2026-47352 published to NVD
2026-06-09 - Last updated in NVD database
TYPO3 Core SA-2026-015 - Vendor advisory released, see TYPO3 Security Advisory

Technical Details for CVE-2026-47352

Vulnerability Analysis

The vulnerability resides in several TYPO3 backend controllers that expose file metadata through Backend API routes. The affected handlers accept a file or processed-file identifier from request query parameters and return metadata or redirect to public file URLs without verifying that the requesting backend user has read permission on the underlying file. Because TYPO3 enforces file isolation through file mounts and storage permissions, the absence of these checks allows any authenticated editor to access metadata for files outside their assigned scope.

Identified affected controllers include ImageProcessController and LinkController within typo3/sysext/backend/Classes/Controller/. An authenticated attacker iterating over numeric id values can enumerate processed files across the system and retrieve URLs or descriptive metadata they should not see.

Root Cause

The root cause is a missing authorization check [CWE-862]. The controllers loaded a file object based on a user-supplied identifier and returned data without invoking checkActionPermission('read') on the underlying file resource. TYPO3's permission model relies on explicit calls to these resource-level checks, and the omission bypasses file mount and storage restrictions configured for the backend user.

Attack Vector

An attacker authenticates with any valid backend user account, then issues crafted GET requests against vulnerable Backend API routes such as the image processing endpoint with sequentially varied id parameters. The server processes the request and returns metadata or a redirect to the public URL of files outside the user's permitted scope. No social engineering or additional privileges are required beyond a low-privilege backend login.

php

// Security patch in typo3/sysext/backend/Classes/Controller/File/ImageProcessController.php
        $processedFileId = (int)($request->getQueryParams()['id'] ?? 0);
        try {
            $processedFile = $this->imageProcessingService->process($processedFileId);
+           if (!$processedFile->getOriginalFile()->checkActionPermission('read')) {
+               return new HtmlResponse('', 403);
+           }

            return new RedirectResponse(
                GeneralUtility::locationHeaderUrl($processedFile->getPublicUrl() ?? '')

Source: TYPO3 commit 17a3b78. The patch adds an explicit checkActionPermission('read') call on the original file and returns HTTP 403 when the backend user lacks permission.

Detection Methods for CVE-2026-47352

Indicators of Compromise

Backend access logs showing repeated requests to ImageProcessController or LinkController endpoints with sequentially incrementing id query parameters from a single authenticated session.
HTTP 200 or 302 responses on Backend API metadata routes for file identifiers that fall outside a user's configured file mounts.
Unusual volume of Backend API calls from low-privilege editor accounts during off-hours.

Detection Strategies

Audit TYPO3 backend access logs for enumeration patterns against file-related routes such as /typo3/index.php?route=/file/ and the image processing endpoint.
Correlate authenticated be_user identifiers with file storage mount assignments and flag access to file IDs outside their scope.
Deploy web application firewall rules that rate-limit repeated parameter-incrementing requests to TYPO3 Backend API routes.

Monitoring Recommendations

Forward TYPO3 application and web server logs to a centralized SIEM for correlation across backend user sessions and file resource accesses.
Alert on backend accounts triggering high request rates to ImageProcessController or link metadata endpoints.
Track HTTP 403 responses added by the patched controllers to validate that permission enforcement is active after upgrade.

How to Mitigate CVE-2026-47352

Immediate Actions Required

Upgrade TYPO3 CMS to a patched release: 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 or later.
Review backend user accounts and disable or restrict accounts that are no longer required, reducing the authenticated attack surface.
Audit file mount and storage configurations to ensure least-privilege assignments for all editor roles.

Patch Information

TYPO3 released fixes referenced in commits 17a3b78 and bfe7c35. The patches add checkActionPermission('read') calls to the affected controllers and import InsufficientFolderAccessPermissionsException for folder-level checks. Full details are documented in the TYPO3 Security Advisory TYPO3-CORE-SA-2026-015.

Workarounds

No official workaround exists; upgrading to a patched version is the supported remediation.
As an interim control, restrict backend access using IP allowlisting at the web server or load balancer to limit who can reach /typo3/ Backend API routes.
Reduce the number of users with backend accounts and enforce multi-factor authentication for any remaining editors.

bash

# Example: upgrade TYPO3 via Composer to the patched release branch
composer require typo3/cms-core:"^13.4.31" --update-with-all-dependencies
composer update --no-dev

# Verify installed version
./vendor/bin/typo3 --version