GHSA-4F2F-JR2M-J7P4 Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-68jx-f42c-7599. This link is maintained to preserve external references. Original Description The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, whe...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418

TYPO3 CMS contains a Broken Access Control in Backend and Install Tool for versions 13.0.0-13.4.33 and 14.0.0-14.3.5. Root cause: referrer enforcement from TYPO3 core SA-2020-006 became ineffective in v13.0+ because the backend/install tooling are served from the site’s main entry script rather t...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

PT-2026-70202

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

PT-2026-70197

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

PT-2026-70145

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.2 Description Broken access control allows unauthenticated remote attackers to read all form submissions, including personally identifiable information, through the admin form-submission viewer. This occurs because the view...

CVE-2026-72601: Improper Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72557: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72784: Server-Side Request Forgery (SSRF)

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT...

CVE-2026-72782: Exposure of Resource to Wrong Sphere

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72780: Authentication Bypass by Capture-replay

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-72779: Incomplete List of Disallowed Inputs

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

CVE-2026-72785: Incorrect Authorization

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72778: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...