Vulnerability advisory

GHSA-mh3r-6cp5-hc2j

Authentication Bypass in TYPO3 Frontend

Published Jun 5, 2024Updated Dec 2, 2024OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected versions

typo3/cms Packagist

Affected	Fixed in
`8.2.0` to before 8.6.1	`8.6.1`Advisories →
Also listed as affected (9) `8.2.0` `8.2.1` `8.3.0` `8.3.1` `8.4.0` `8.4.1` `8.5.0` `8.5.1` `8.6.0`

Description

Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted (e.g. disabled) frontend users.

References

Webgithub.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2017-02-28-1.yaml ↗