High 7.5Published Sep 8, 2026

CVE-2026-85400TYPO3 CMS - Missing Authorization in lowlevel commands

Updated under an hour ago (Oct 28, 2026, 3:10 AM ET)

Does this affect you?

It affects TYPO3 CMS. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TYPO3 CMS

Exploited in the last 30 days

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

CVSS: 7.5 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-862, CWE-266
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: TYPO3
NVD analysis: Deferred
Record last updated: Sep 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TYPO3 TYPO3 CMS typo3:cms (from the name)	from 14.2.0 before 14.3.7	CNA record

References

References

https://news.typo3.com/security/advisory/typo3-core-sa-2026-023	vendor-advisory
https://github.com/TYPO3/typo3/commit/b8abe36978c63a0625aee70df078895216e7ee27	patch
https://github.com/TYPO3/typo3/commit/e15da7ba0218532240578b471152f76c13cb4154	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.