CVE-2026-77132: TYPO3 CMS Information Disclosure Flaw

CVE-2026-77132 Overview

CVE-2026-77132 is a broken access control vulnerability in the TYPO3 CMS backend localization wizard. Several AJAX routes used by the wizard failed to perform authorization checks. Authenticated, low-privileged backend users can query these endpoints to retrieve information about records and content elements outside their permitted page scope. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Exploitation requires a valid low-privileged backend account but no user interaction. The impact is limited to information disclosure and does not permit modification of data or service disruption.

Critical Impact
Authenticated backend users can enumerate metadata about records and content elements they are not authorized to view via unprotected AJAX endpoints in the localization wizard.

Affected Products

TYPO3 CMS versions 10.0.0 through 10.4.59
TYPO3 CMS versions 11.0.0 through 11.5.53 and 12.0.0 through 12.4.48
TYPO3 CMS versions 13.0.0 through 13.4.34 and 14.0.0 through 14.3.6

Discovery Timeline

2026-09-08 - CVE-2026-77132 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77132

Vulnerability Analysis

The TYPO3 backend localization wizard exposes several AJAX endpoints that render information for translating records across languages. These endpoints accept parameters such as recordType, recordUid, sourceLanguage, and targetLanguage, and return record metadata used to build wizard steps. Prior to the patch, these routes did not verify whether the calling backend user held page-level permissions for the requested recordUid.

A low-privileged authenticated user can craft direct AJAX requests to routes such as wizard_localization_get_handlers and retrieve metadata about records living on pages outside their permitted scope. The disclosed data includes record types, titles, and localization handler details that expose the site's structure and content taxonomy.

Root Cause

The root cause is missing authorization in the LocalizationController handling backend wizard requests. The controller resolved records by UID without invoking a page access check against the current BackendUserAuthentication context. The fix adds page permission verification using the Permission bitmask before returning record data.

Attack Vector

An attacker with any backend account issues authenticated AJAX requests to the vulnerable wizard endpoints, iterating recordUid values to enumerate records across the installation. Because the AJAX routes were reachable from the standard backend session, no privilege escalation primitive is required.

php

// Security patch: typo3/sysext/backend/Classes/Controller/Page/LocalizationController.php
 use TYPO3\CMS\Backend\Domain\Repository\Localization\LocalizationRepository;
 use TYPO3\CMS\Backend\Utility\BackendUtility;
 use TYPO3\CMS\Backend\View\BackendLayoutView;
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
 use TYPO3\CMS\Core\DataHandling\DataHandler;
 use TYPO3\CMS\Core\Http\JsonResponse;
 use TYPO3\CMS\Core\Http\Response;
 use TYPO3\CMS\Core\Imaging\IconFactory;
 use TYPO3\CMS\Core\Imaging\IconSize;
+use TYPO3\CMS\Core\Type\Bitmask\Permission;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Core\Versioning\VersionState;
// Source: [TYPO3 Commit 1c63ce806d1](https://github.com/TYPO3/typo3/commit/1c63ce806d1ccac839f4aa54ac7f48a22dd7ea64)

The patch imports BackendUserAuthentication and the Permission bitmask so the controller can enforce page access checks before returning localization data.

Detection Methods for CVE-2026-77132

Indicators of Compromise

Repeated backend AJAX requests to wizard_localization_get_handlers or related localization wizard routes from a single backend user session.
Sequential or scripted iteration of the recordUid parameter across a wide range of values in a short time window.
Localization wizard requests originating from user accounts that do not normally perform translation workflows.

Detection Strategies

Enable TYPO3 backend audit logging and review sys_log entries for AJAX calls to localization endpoints made by low-privileged users.
Correlate web server access logs for requests matching the pattern /typo3/ajax/wizard/localization/* with the authenticated backend user identifier.
Alert on backend sessions that access recordUid values corresponding to pages outside the user's assigned mount points.

Monitoring Recommendations

Forward TYPO3 web server logs and sys_log data into a central SIEM or data lake for query-based hunting on wizard endpoints.
Baseline normal localization wizard usage per user role, then alert on volumetric deviations from that baseline.
Track backend account activity across mount points to detect attempts to enumerate records outside permitted scopes.

How to Mitigate CVE-2026-77132

Immediate Actions Required

Upgrade TYPO3 CMS to a patched release: 10.4.60, 11.5.54, 12.4.49, 13.4.35, or 14.3.7 or later, per TYPO3 Security Advisory SA-2026-022.
Audit backend user accounts and remove or disable inactive low-privileged accounts that no longer require access.
Review recent sys_log and web server logs for suspicious calls to localization wizard AJAX routes.

Patch Information

The fix is delivered in TYPO3 commits 1c63ce806d1, 35e070fc65, and c232421325. The PHP change adds Permission bitmask checks in LocalizationController. Companion TypeScript changes in localization-wizard.ts and handler-selection-step.ts correctly handle undefined record info returned when access is denied.

Workarounds

Restrict backend access at the network layer to trusted administrator networks or VPN clients until patching is complete.
Enforce the principle of least privilege by limiting backend user group permissions to only the required page trees and tables.
Disable unused backend accounts and require multi-factor authentication for all remaining backend users.

bash

# Verify patched TYPO3 version via Composer
composer show typo3/cms-core | grep versions
# Upgrade to a patched release (example for the 13.x branch)
composer require typo3/cms-core:^13.4.35 --update-with-dependencies