GHSA-gwfx-p7mr-f92v
Missing Access Check in TYPO3 CMS
GHSA-gwfx-p7mr-f92v is a critical vulnerability (CVSS 9.0) in typo3/cms, published June 5, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.25.
- Severity
- 9.0 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.2.25typo3/cms +5 more
Description
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.25 | 6.2.25 |
typo3/cmsPackagist | 7.6.0 up to 7.6.8 | 7.6.8 |
typo3/cmsPackagist | 8.0.0 up to 8.1.1 | 8.1.1 |
typo3/cmsPackagist | 6.2.0 up to 6.2.25, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 20 moreShow less6.2.136.2.146.2.156.2.166.2.176.2.186.2.196.2.26.2.206.2.216.2.226.2.236.2.246.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.25 |
typo3/cmsPackagist | 7.6.0 up to 7.6.8, plus listed versions 7.6.17.6.27.6.37.6.47.6.57.6.67.6.7 | 7.6.8 |
typo3/cmsPackagist | 8.0.0 up to 8.1.1, plus listed versions 8.0.18.1.0 | 8.1.1 |
What each source reports
GitHub Advisories Score used
Missing Access Check in TYPO3 CMS
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
- Record
GHSA-gwfx-p7mr-f92v- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Missing Access Check in TYPO3 CMS
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
- Record
GHSA-gwfx-p7mr-f92v- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.