GHSA-82vp-jr39-4j2j
TYPO3 Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
TYPO3 Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
- Record
GHSA-82vp-jr39-4j2j- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-488
- Updated
- 2026-11-02
OSV
TYPO3 Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
- Record
GHSA-82vp-jr39-4j2j- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-488
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 up to 8.7.27 | 8.7.27 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.8 | 9.5.8 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.27, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 15 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.7v8.7.8v8.7.9 | 8.7.27 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.8, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 12 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7 | 9.5.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-82vp-jr39-4j2j is a high vulnerability (CVSS 8.2) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.27.
References
github.com/TYPO3-CMS/core/commit/c8c08ca0c26db02753c243e175a8a045628341b6
typo3.org/security/advisory/typo3-core-sa-2019-018