TYPO3 CMS has Broken Access Control in its Form Framework

🗓️ 12 Jun 2026 19:32:09Reported by GitHub Advisory DatabaseType

TYPO3 Form Framework allowed mixed-case uploads to bypass checks, enabling admin accounts.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-47346	10 Jun 202603:07	–	circl
CVE	CVE-2026-47346	9 Jun 202610:50	–	cve
Cvelist	CVE-2026-47346 TYPO3 CMS - Broken Access Control in Form Framework	9 Jun 202610:50	–	cvelist
EUVD	EUVD-2026-35393	12 Jun 202619:32	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework	9 Jun 202608:56	–	friendsofphp
NVD	CVE-2026-47346	9 Jun 202611:16	–	nvd
OSV	GHSA-HWVQ-2W67-RVXP TYPO3 CMS has Broken Access Control in its Form Framework	12 Jun 202619:32	–	osv
Positive Technologies	PT-2026-47739	9 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47346	10 Jun 202614:59	–	redhatcve
Vulnrichment	CVE-2026-47346 TYPO3 CMS - Broken Access Control in Form Framework	9 Jun 202610:50	–	vulnrichment

Vulners

Node

typo3 cms-formRange14.0.0–14.3.3composer

typo3 cms-formRange13.0.0–13.4.31composer

typo3 cms-formRange12.0.0–12.4.46composer

typo3 cms-formRange11.0.0–11.5.51composer

typo3 cms-formRange<10.4.57composer

typo3 cms-coreRange14.0.0–14.3.3composer

typo3 cms-coreRange13.0.0–13.4.31composer

typo3 cms-coreRange12.0.0–12.4.46composer

typo3 cms-coreRange11.0.0–11.5.51composer

typo3 cms-coreRange<10.4.57composer

Source	Link
github	www.github.com/TYPO3/typo3/security/advisories/GHSA-hwvq-2w67-rvxp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47346
github	www.github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47
github	www.github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47346.yaml
typo3	www.typo3.org/security/advisory/typo3-core-sa-2026-008
github	www.github.com/advisories/GHSA-hwvq-2w67-rvxp

12 Jun 2026 19:32Current

6Medium risk

Vulners AI Score6

CVSS 47.6

EPSS0.0003

SSVC