CVE-2026-19418 in TYPO3
Summary
by MITRE • 08/11/2026
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 https://news.typo3.com/security/advisory/typo3-core-sa-2020-006 ( CVE-2020-11069 https://www.cve.org/CVERecord ) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described in CVE-2020-11069 represents a critical authorization bypass flaw that emerged from TYPO3's referrer enforcement mechanism during the transition to version 13.0. This security issue stems from a fundamental change in how TYPO3 CMS handles backend and Install Tool access control, specifically related to how the system validates the origin of requests. The vulnerability was introduced through TYPO3-CORE-SA-2020-006 which initially addressed referrer validation, but the subsequent architectural changes in version 13.0 rendered this protection ineffective, creating a significant security gap that could be exploited by attackers.
The technical flaw occurs at the core of TYPO3's access control implementation where the system determines whether a request originated from the backend or Install Tool by comparing the HTTP referrer header against the directory path of the entry script. Prior to version 13.0, this worked correctly because backend and Install Tool applications were served from dedicated directories within the typo3/ folder structure. However, beginning with TYPO3 v13.0, the system started serving these administrative interfaces from the site's main entry script located at the site root directory rather than maintaining separate backend directories. This architectural change fundamentally altered the validation logic, causing the system to accept requests from any domain within the same TYPO3 instance that had a valid referrer, regardless of whether those requests actually originated from legitimate administrative contexts.
The operational impact of this vulnerability is severe and directly relates to the principle of least privilege in security design. Attackers who can execute JavaScript on any page within the same TYPO3 instance, typically through cross-site scripting vulnerabilities, can leverage this flaw to make authenticated requests to backend routes and Install Tool endpoints. This creates a pathway for privilege escalation where malicious actors can perform administrative actions using the session credentials of authenticated users. The vulnerability specifically affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5, representing a significant window of affected releases that would allow attackers to exploit this authorization bypass without requiring additional authentication credentials.
This vulnerability aligns with CWE-284, which describes improper access control issues where systems fail to properly enforce access restrictions, and also maps to ATT&CK technique T1078.004 for valid accounts and T1566 for credential harvesting through social engineering or exploitation of existing access. The flaw demonstrates how architectural changes in web applications can inadvertently introduce security vulnerabilities, particularly when access control mechanisms rely on HTTP headers that can be manipulated or spoofed. Organizations running affected TYPO3 versions face potential exposure to data manipulation, unauthorized administrative actions, and possible complete system compromise if attackers can establish persistent access through XSS exploitation.
Mitigation strategies for this vulnerability should focus on immediate patching of affected TYPO3 versions to the latest stable releases where the referrer enforcement has been properly restored or replaced with more robust authentication mechanisms. Administrators should also implement additional network-level protections such as web application firewalls that can monitor and filter requests to administrative endpoints, ensuring that only legitimate internal sources can access these critical paths. The security community should consider implementing more robust authentication tokens or API key validation mechanisms rather than relying solely on referrer header validation, which is inherently unreliable in modern web environments where XSS vulnerabilities can easily manipulate HTTP headers. Additionally, organizations should perform comprehensive security audits of their TYPO3 installations to ensure no other similar architectural flaws exist that could compromise system integrity.