TYPO3 CMS 13-14 Referrer Bypass Enables Backend Access via SameDomain JS
CVE-2026-19418 Published on August 11, 2026
TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
Vulnerability Analysis
CVE-2026-19418 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Origin Validation Error
The software does not properly verify that the source of data or communication is valid.
What is a Session Riding Vulnerability?
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
CVE-2026-19418 has been classified to as a Session Riding vulnerability or weakness.
Products Associated with CVE-2026-19418
Want to know whenever a new CVE is published for TYPO3? stack.watch will email you.
Affected Versions
TYPO3 CMS:- Version 13.0.0 and below 13.4.34 is affected.
- Version 14.0.0 and below 14.3.6 is affected.
- Version 13.0.0 and below 13.4.34 is affected.
- Version 14.0.0 and below 14.3.6 is affected.
- Version 14.0.0 and below 14.3.6 is affected.