Live › vulnerability › CVE-2026-112239
Go to dashboardThe extension has a backend endpoint that writes a submitted value into a chosen field of a chosen page record without checking permissions or limiting which fields may change. An authenticated backend user can therefore alter any page property, including access permissions and configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the affected extension with TYPO3 backend users who are not fully trusted, since any logged-in backend user can exploit it. The sources do not name the extension or its versions, so teams should check whether they have an extension that adds this backend endpoint. Installations with no backend users beyond administrators are less exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
This page as .md · .json · in your agent: get_signal("CVE-2026-112239")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.