CVE-2026-6553 Details
Description
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
A vulnerability in TYPO3 CMS version 14.2.0 allows for cleartext passwords to be stored in the 'uc' and 'user_settings' fields of the 'be_users' database table. This issue arises when users change their passwords through the backend user settings module, which incorrectly merges password data with user interface settings, leading to sensitive data exposure.
Update TYPO3 to version 14.3.0 LTS, which addresses the vulnerability by preventing cleartext password storage. After updating, execute the 'User Settings Scrubbing' wizard in the TYPO3 Install Tool to remove any previously stored cleartext passwords from the 'uc' and 'user_settings' fields of the 'be_users' table. Additionally, assign new passwords to affected backend user accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TYPO3/typo3/commit/9a6e913f70767f63b322ae3e2d2f4e302624c291 | TYPO3 | Patch |
| https://typo3.org/security/advisory/typo3-core-sa-2026-005 | TYPO3 | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| typo3 typo3 | 14.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | TYPO3 |