CVE-2026-85400: TYPO3 CMS Privilege Escalation Vulnerability

CVE-2026-85400 Overview

CVE-2026-85400 is a privilege escalation vulnerability in TYPO3 CMS affecting versions 14.2.0 through 14.3.6. Backend administrators without system maintainer privileges could schedule the configuration:read, configuration:set, and configuration:show commands through the scheduler. This allowed them to modify arbitrary system configuration normally restricted to system maintainers. An attacker with an administrator-level backend account could escalate to system maintainer privileges or trigger a denial of service. The flaw is categorized as an incorrect privilege assignment issue [CWE-266].

Critical Impact
Backend administrators can bypass the system maintainer boundary and modify system/settings.php, enabling full privilege escalation or denial of service on affected TYPO3 installations.

Affected Products

TYPO3 CMS 14.2.0 through 14.3.6
lowlevel system extension shipping configuration:* commands
Installations exposing the scheduler module to backend administrators

Discovery Timeline

2026-09-08 - CVE-2026-85400 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85400

Vulnerability Analysis

TYPO3 separates backend administrators from system maintainers. System maintainers are the only role permitted to alter core configuration stored in system/settings.php. The configuration:read, configuration:set, and configuration:show CLI commands enforce this boundary when executed directly.

The scheduler module, however, allowed any backend administrator to register these commands as scheduled tasks. When the scheduler executed the tasks, the privilege check was effectively bypassed because the commands ran in the scheduler's execution context. This design gap violates the principle of least privilege and enables lateral movement between administrative roles.

Root Cause

The root cause is the absence of a AsNonSchedulableCommand attribute on the configuration management commands in the lowlevel extension. Without this marker, the scheduler treated the commands as valid task candidates and did not enforce the system maintainer restriction that applies to interactive execution.

Attack Vector

Exploitation requires a valid backend administrator account, but no system maintainer role. The attacker opens the scheduler module, creates a new task, selects configuration:set as the command, and supplies a configuration path and value. On execution, the scheduler writes to system/settings.php. Attackers can promote their own user ID into the SYS/systemMaintainers array, disable security features, or corrupt configuration to cause a denial of service.

php

 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Style\SymfonyStyle;
+use TYPO3\CMS\Core\Attribute\AsNonSchedulableCommand;
 use TYPO3\CMS\Core\Configuration\ConfigurationManager;

 /**
  * CLI command for setting a configuration value in system/settings.php
  */
 #[AsCommand('configuration:set', 'Set a configuration value in system/settings.php')]
+#[AsNonSchedulableCommand]
 class ConfigurationSetCommand extends Command
 {
     public function __construct(

Source: TYPO3 patch commit b8abe36. The fix decorates ConfigurationSetCommand and ConfigurationRemoveCommand with #[AsNonSchedulableCommand], preventing the scheduler from listing or executing them.

Detection Methods for CVE-2026-85400

Indicators of Compromise

Unexpected modifications to typo3conf/system/settings.php, particularly to the SYS/systemMaintainers array.
Scheduler task records referencing configuration:read, configuration:set, or configuration:show created before patching.
New or elevated user IDs appearing in the system maintainer list without an approved change request.

Detection Strategies

Audit the TYPO3 scheduler task table (tx_scheduler_task) for command references matching the affected configuration commands.
Compare current system/settings.php contents against version control or a known-good backup to identify unauthorized changes.
Review backend user activity logs for administrator accounts that accessed the scheduler module and created tasks.

Monitoring Recommendations

Enable file integrity monitoring on typo3conf/system/settings.php and alert on any write event.
Forward TYPO3 backend audit logs to a centralized SIEM and alert on scheduler task creation by non-maintainer administrators.
Track backend account privilege changes to catch attempts to add or remove system maintainer IDs.

How to Mitigate CVE-2026-85400

Immediate Actions Required

Upgrade affected installations to TYPO3 CMS 14.3.7 or later as described in TYPO3 Security Advisory 2026-023.
Review the SYS/systemMaintainers configuration and remove any unauthorized user IDs.
Delete scheduler tasks that reference configuration:read, configuration:set, or configuration:show.
Rotate credentials for backend administrator accounts if unauthorized activity is suspected.

Patch Information

The TYPO3 project resolved the issue in commits b8abe36 and e15da7b. Both commits add the #[AsNonSchedulableCommand] attribute to ConfigurationSetCommand and ConfigurationRemoveCommand, ensuring these commands cannot be registered as scheduler tasks. Full remediation details are published in TYPO3 Security Advisory 2026-023.

Workarounds

Restrict access to the scheduler backend module so only trusted system maintainers can create or edit tasks.
Audit and remove existing scheduler tasks that invoke the affected configuration commands.
Apply operating system permissions on system/settings.php that block modification by the web server user outside deployment windows.

bash

# Verify current TYPO3 version and upgrade via Composer
composer show typo3/cms-core
composer require typo3/cms-core:"^14.3.7" --update-with-dependencies

# Audit scheduler tasks for affected commands
mysql -e "SELECT uid, description, task_type FROM tx_scheduler_task \
  WHERE description LIKE '%configuration:set%' \
     OR description LIKE '%configuration:read%' \
     OR description LIKE '%configuration:show%';" typo3_db