CVE-2026-85400: falha de alta gravidade em TYPO3 CMS
TYPO3 CMS - Missing Authorization in lowlevel commands
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TYPO3 · TYPO3 CMSCVEs relacionadas — TYPO3 CMS
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15098HIGHMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSEPSS 2.2%CVE-2020-11067HIGHDeserialization of Untrusted Data in TYPO3 CMSEPSS 2.0%CVE-2020-15099HIGHExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSEPSS 1.8%CVE-2020-11066HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSEPSS 1.5%CVE-2020-11063LOWObservable Response Discrepancy in TYPO3 CMSEPSS 1.2%CVE-2020-11069HIGHCross-Site Request Forgery in TYPO3 CMSEPSS 0.7%