CVE-2026-85400 Details

A vulnerability exists in TYPO3 CMS versions 14.2.0 prior to 14.3.6, allowing backend administrators without system maintainer privileges to schedule and execute configuration-related commands. This unauthorized access enabled them to modify system-wide configuration arbitrarily, a capability typically reserved for system maintainers. As a result, these administrators could potentially escalate their privileges to gain system maintainer rights or cause a denial-of-service condition. Exploitation of this vulnerability requires an administrator-level backend user account.

Users are advised to update TYPO3 to version 14.3.7 LTS, which addresses this vulnerability by disallowing the scheduled execution of the affected configuration commands. Existing scheduler tasks using these commands will no longer function and should be removed. If needed, schedule configuration updates can be managed through custom cronjobs.