Vulnerability advisory

GHSA-qcmw-6rm2-5x78

TYPO3 CMS has Broken Access Control in its DataHandler

Published Jun 12, 2026Updated Sep 10, 2026OSV record ↗

Severity

Affected versions

Affected	Fixed in
`13.0.0` to before 13.4.31	`13.4.31`Advisories →
Also listed as affected (39) `v13.0.0` `v13.0.1` `v13.1.0` `v13.1.1` `v13.2.0` `v13.2.1` `v13.3.0` `v13.3.1` `v13.4.0` `v13.4.1` `v13.4.10` `v13.4.11` `v13.4.12` `v13.4.13` `v13.4.14` `v13.4.15` `v13.4.16` `v13.4.17` `v13.4.18` `v13.4.19` `v13.4.2` `v13.4.20` `v13.4.21` `v13.4.22` `v13.4.23` `v13.4.24` `v13.4.25` `v13.4.26` `v13.4.27` `v13.4.28` `v13.4.29` `v13.4.3` `v13.4.30` `v13.4.4` `v13.4.5` `v13.4.6` `v13.4.7` `v13.4.8` `v13.4.9`
`14.0.0` to before 14.3.3	`14.3.3`Advisories →
Also listed as affected (9) `v14.0.0` `v14.0.1` `v14.0.2` `v14.1.0` `v14.1.1` `v14.2.0` `v14.3.0` `v14.3.1` `v14.3.2`

Backend users were able to move records to a different page without having edit permissions on the source page.

Update to TYPO3 versions 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team member Torben Hansen for fixing it.