Vulnerability advisory

CVE-2026-47351

TYPO3 CMS - Broken Access Control in Clipboard

Published Jun 9, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
408adc7ac146134aad8690d40935da5ae42dc2b2 to before 59bfeaaf0136dfe17011786ce825884e48bedc8d	`59bfeaaf0136dfe17011786ce825884e48bedc8d`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before e16ec78165a7d60f09dcac04bfbb309409e174b3	`e16ec78165a7d60f09dcac04bfbb309409e174b3`
Not specified	`932fbb9fcea25094e8bcc0f0ec5aab56b1d92451`
Not specified	`2740707563343d78184c0b7c6303a7484553d7f3`
Also listed as affected (60) `v14.3.2` `v13.4.30` `v14.3.1` `v13.4.29` `v14.3.0` `v13.4.28` `v14.2.0` `v13.4.27` `v13.4.26` `v14.1.0` `v13.4.25` `v13.4.24` `v13.4.23` `v13.4.22` `v13.4.21` `v14.0.0` `v13.4.20` `v13.4.19` `v13.4.18` `v13.4.17` `v13.4.16` `v13.4.15` `v13.4.14` `v13.4.13` `v13.4.12` `v13.4.11` `v13.4.10` `v13.4.9` `v13.4.8` `v13.4.7` `v13.4.6` `v13.4.5` `v13.4.4` `v13.4.3` `v13.4.2` `v13.4.1` `v13.4.0` `v13.3.0` `v13.2.1` `v13.2.0` `v13.1.0` `v13.0.0` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0` `v11.5.3` `v11.5.2` `v11.5.1` `v11.5.0` `v11.4.0` `v11.3.0` `v11.2.0` `v11.1.0` `v11.0.0` `v10.4.3` `v10.4.2` `v10.4.1` `v10.4.0`

Description

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

CVE-2026-47351

Affected versions

Repository

Description

References