{"id":"CVE-2026-112239","kind":"vulnerability","aliases":["CVE-2026-112239"],"related":[],"title":"TYPO3 extension lets any backend user edit any page field","description":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.","summary":"The extension has a backend endpoint that writes a submitted value into a chosen field of a chosen page record without checking permissions or limiting which fields may change. An authenticated backend user can therefore alter any page property, including access permissions and configuration.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","self-hosted","typo3"],"not_affected_if":["auth-required"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T10:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:29:22+00:00","updated_at":"2026-10-25T03:29:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:29:22Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"TYPO3 extension lets any backend user edit any page field","impact":"high","summary":"The extension has a backend endpoint that writes a submitted value into a chosen field of a chosen page record without checking permissions or limiting which fields may change. An authenticated backend user can therefore alter any page property, including access permissions and configuration.","category":"package","nicknames":[],"who_cares":["typo3","self-hosted","cms"],"confidence":0.5,"needs_auth":"yes","worst_case":"Backend user escalates privileges by rewriting page access and configuration","analyst_note":"Identify the affected TYPO3 extension, its vulnerable versions and the fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112239 or the TYPO3 security advisory.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Sites running the affected extension with TYPO3 backend users who are not fully trusted, since any logged-in backend user can exploit it. The sources do not name the extension or its versions, so teams should check whether they have an extension that adds this backend endpoint. Installations with no backend users beyond administrators are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000571,"input_tokens":3310,"output_tokens":479,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112239':13A,16A '-2026':12A,15A 'access':63B,115C 'alter':58B 'authent':53B,102C 'backend':5A,27B,54B,71C,103C 'chang':51B,100C,107C 'check':44B,89C 'chosen':36B,40B 'cms':17B 'configur':66B,118C 'cve':11A,14A 'edit':7A 'endpoint':28B,72C 'extens':2A,24B,68C 'field':10A,37B,49B,81C,97C 'grant':122C 'host':21B 'includ':62B,113C 'let':3A 'limit':47B,95C 'may':50B 'neither':88C 'outsid':119C 'packag':18B 'page':9A,41B,60B,85C,112C 'permiss':45B,64B,93C,116C 'properti':61B,109C 'provid':69C 'record':42B,86C 'scope':121C 'self':20B 'self-host':19B 'submit':32B,76C,80C,84C 'therefor':57B,106C 'typo3':1A,22B 'user':6A,55B,91C,104C 'valu':33B,77C 'without':43B 'write':30B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the affected extension with TYPO3 backend users who are not fully trusted, since any logged-in backend user can exploit it. The sources do not name the extension or its versions, so teams should check whether they have an extension that adds this backend endpoint. Installations with no backend users beyond administrators are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112239","severity":null,"published_at":"2026-10-20T10:17:04+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}