Packagist/typo3/cms-backend CVE-2026-19418: high, EPSS 0.24%

TYPO3 CMS - Broken Access Control in Backend and Install Tool

Action: Upgrade typo3/cms-backend to 13.4.34 or later.

composer require typo3/cms-backend:13.4.34

Affected

Fixed versions

Sources

• osv: GHSA-68jx-f42c-7599
• https://github.com/TYPO3/typo3/security/advisories/GHSA-68jx-f42c-7599
• https://nvd.nist.gov/vuln/detail/CVE-2026-19418
• https://github.com/TYPO3/typo3/commit/4a75e862c589c85d795d7c65dcdc835f8f413efc
• https://github.com/TYPO3/typo3/commit/a0e8ee06a40e959b9e7b06a4b1cb19d3a0d3dcf7
• https://github.com/TYPO3/typo3/commit/ae0abd329d52285fe6e92804c3608820ad45e872
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-19418.yaml
• https://github.com/TYPO3/typo3
• https://news.typo3.com/security/advisory/typo3-core-sa-2026-021
• https://typo3.org/security/advisory/typo3-core-sa-2020-006
• https://typo3.org/security/advisory/typo3-core-sa-2026-021

CVE-2026-19418 · published 2026-09-01T21:31:42Z · modified 2026-09-01T21:55:52.105169Z · JSON