Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-47349 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8 TYPO3Source CodeVendor
https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a TYPO3Source CodeVendor
https://typo3.org/security/advisory/typo3-core-sa-2026-011 TYPO3AdvisoryRemedyVendor

Weakness Enumeration

CWE-IDCWE NameSource
CWE-862Missing AuthorizationTYPO3

Affected Products

ProductVersions
TYPO3
>= 10.0.0, <= 10.4.56 (semver)
>= 11.0.0, <= 11.5.50 (semver)
>= 12.0.0, <= 12.4.45 (semver)
>= 13.0.0, <= 13.4.30 (semver)
>= 14.0.0, <= 14.3.2 (semver)

CPE

  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

Remediation

  • Upgrade: 10.4.57 ELTSmoderate effort
  • Upgrade: 11.5.51 ELTSmoderate effort
  • Upgrade: 12.4.46 ELTSmoderate effort
  • Upgrade: 13.4.31 LTSmoderate effort
  • Upgrade: 14.3.3 LTSmoderate effort

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-47349
NVD Published Date:
Jun 9, 2026
NVD Last Modified:
Jul 23, 2026
Source:
TYPO3