CVE-2026-19418: Broken Access Control and Cross-Site Request Forgery in TYPO3 CMS Core

CVE-2026-19418 represents a regression in the boundary isolation mechanisms of the TYPO3 CMS core, specifically affecting the Backend (ext:backend) and Install Tool (ext:install) subcomponents. In TYPO3, administrative and configuration endpoints are protected against unauthorized requests by evaluating the request origin.

Historically, this boundary was maintained by comparing the referrer path against the physical script directories. The architectural consolidation in TYPO3 v13.0, which unified the entry points for frontend and backend under the site root script, unintentionally disabled this protection mechanism.

The vulnerability is classified under CWE-346 (Origin Validation Error) and CWE-352 (Cross-Site Request Forgery). The consequence is a cross-application security boundary failure, permitting frontend code to interact seamlessly with sensitive administrative routes.

The flaw lies within the referrer verification logic implemented in TYPO3\CMS\Core\Http\Security\ReferrerEnforcer. Prior to TYPO3 v13.0, backend routes resolved to a sub-path such as https://example.com/typo3/. This distinct subfolder was matched against the $this->requestDir parameter during request processing.

In TYPO3 v13.0, both frontend and backend entry points were consolidated to /index.php at the site root. As a consequence, the resolved $this->requestDir parameter became /. When evaluating a request, the enforcer executes str_starts_with($referrer, $requestDir) to determine same-origin access.

Because every frontend URL begins with the site root path, any request initiated from a frontend page (e.g., https://example.com/blog) is incorrectly marked as TYPE_REFERRER_SAME_ORIGIN | TYPE_REFERRER_SAME_SITE. This misclassification treats generic frontend origins with the same authority as backend admin panels, breaking the privilege boundary.

The vulnerable component in ReferrerEnforcer.php evaluated referrers using a generic comparison against the request directory.

// Vulnerable code in TYPO3 v13.0.0 - 13.4.33
protected function resolveReferrerType(ServerRequestInterface $request, string $requestHost, string $requestDir): int
{
    $referrer = $request->getServerParams()['HTTP_REFERER'] ?? '';
    if ($referrer === '') {
        return self::TYPE_REFERRER_EMPTY;
    }
    // All paths starting with the root request directory (/) were treated as Same-Origin
    if (str_starts_with($referrer, $requestDir)) {
        return self::TYPE_REFERRER_SAME_ORIGIN | self::TYPE_REFERRER_SAME_SITE;
    }
    // ...
}

The patch addresses this structural vulnerability by making ReferrerEnforcer abstract and establishing discrete enforcers for the backend and the install tool. The backend enforcer uses BackendEntryPointResolver to dynamically resolve the explicit administrative subfolder path, while the install tool enforcer explicitly validates the exact query parameters of the entry point.

// Patched backend logic in TYPO3 v13.4.34 / 14.3.6
protected function resolveReferrerType(ServerRequestInterface $request): int
{
    $referrer = $request->getServerParams()['HTTP_REFERER'] ?? '';
    if ($referrer === '') {
        return self::TYPE_REFERRER_EMPTY;
    }
    // Dynamically retrieve the explicit backend entry point (e.g., /typo3/)
    $entryPointUri = $this->backendEntryPointResolver->getUriFromRequest($request);
    if (str_starts_with($referrer, (string)$entryPointUri)) {
        return self::TYPE_REFERRER_SAME_ORIGIN | self::TYPE_REFERRER_SAME_SITE;
    }
    // Generic site domain referrers are strictly classified as Same-Site (non-privileged)
    $requestHost = rtrim($this->resolveRequestHost($request), '/') . '/';
    if (str_starts_with($referrer, $requestHost)) {
        return self::TYPE_REFERRER_SAME_SITE;
    }
    return 0;
}

An attacker can exploit this vulnerability to perform unauthorized actions by chaining it with a frontend scripting capability, such as stored or reflected Cross-Site Scripting (XSS). The vulnerability requires an active session of a TYPO3 backend administrator.

When the administrator visits a frontend page containing the attacker's payload, the browser automatically executes the script. Since the script is running under the site's domain context, the browser will attach the administrator's active session cookies to any requests directed to the backend route.

The payload issues a fetch or XMLHttpRequest request to administrative endpoints. The browser appends the Referer header corresponding to the current frontend page. Due to the vulnerable ReferrerEnforcer logic, the TYPO3 core accepts this referrer as identical to the backend origin, executing the payload actions.

// Conceptual XSS payload running on the frontend domain
fetch('https://victim-typo3.com/typo3/index.php?route=/ajax/some-admin-action', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'X-Requested-With': 'XMLHttpRequest'
    },
    body: JSON.stringify({
        action: 'create_admin',
        username: 'backdoor_user',
        password: 'Password123!'
    }),
    credentials: 'include' // Attaches administrative session cookies
});

The overall security impact is high, as defined by its CVSS score of 7.3. Exploitation leads to complete administrative compromise of the CMS instance, allowing attackers to manipulate system configurations, dump database contents, and execute arbitrary code on the underlying web server.

The attack path can be modeled as follows:

Because the Install Tool endpoints are also affected, attackers can write files, modify database tables, or install malicious extensions to secure persistent web shells, escalating the initial client-side execution to remote code execution (RCE) on the host environment.

The primary and most effective remediation is upgrading the TYPO3 core. Administrators running TYPO3 v13 must upgrade to version 13.4.34 LTS or later, and those on v14 must upgrade to version 14.3.6 LTS or later.

When immediate upgrading is not possible, organizations should deploy a strict Content Security Policy (CSP). Restricting the script sources (script-src) to nonces or trusted hashes and disabling 'unsafe-inline' prevents the execution of the initial XSS vectors that trigger the CSRF bypass.

Additionally, Web Application Firewalls (WAFs) can be configured to inspect backend requests. Any request targeting administrative paths under /typo3/ that contains a Referer header lacking the explicit backend subdirectory prefix should be dropped or flagged for investigation.