GHSA-q9c4-9v5m-597p
Typo3 Information Disclosure in Backend User Interface
The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.
What each source reports
GitHub AdvisoriesNo score
Typo3 Information Disclosure in Backend User Interface
The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.
- Record
GHSA-q9c4-9v5m-597p- Updated
- 2026-11-02
OSVNo score
Typo3 Information Disclosure in Backend User Interface
The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.
- Record
GHSA-q9c4-9v5m-597p- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 8.0.0 up to 8.7.27 | 8.7.27 |
typo3/cmsPackagist | 9.0.0 up to 9.5.8 | 9.5.8 |
typo3/cmsPackagist | 8.0.0 up to 8.7.27, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 36 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 | 8.7.27 |
typo3/cmsPackagist | 9.0.0 up to 9.5.8, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 12 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7 | 9.5.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-q9c4-9v5m-597p is a vulnerability with no CVSS score yet in typo3/cms, published June 5, 2024. No source lists public exploit code. Fixed in typo3/cms 8.7.27.