CVE-2026-113468 Details
Description
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
A broken access control vulnerability has been identified in the TYPO3 Shop extension, specifically in versions 4.9.3 and below, 5.0.0 to 5.21.0, and 6.0.0 to 6.2.0. The issue arises in the payment notification endpoint for PayPal, which accepts incoming data without verifying its source. As a result, any site visitor can overwrite the payment notification of an order still awaiting payment with arbitrary content. This vulnerability requires a page that includes the shop's order plugin, and it does not affect orders that have already been paid.
Users are advised to update to the patched versions 4.9.4, 5.21.1, or 6.3.0, available from the TYPO3 Extension Manager, Packagist, or the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-036 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| PayPal | <= 4.9.3 (semver) >= 5.0.0, <= 5.21.0 (semver) >= 6.0.0, <= 6.2.0 (semver) |
CPE
Remediation
| |
| TYPO3 Shop | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |