GHSA-wr3c-6c22-m9v6
Privilege Escalation in TYPO3 Neos
It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Privilege Escalation in TYPO3 Neos
It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors.
- Record
GHSA-wr3c-6c22-m9v6- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
Privilege Escalation in TYPO3 Neos
It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors.
- Record
GHSA-wr3c-6c22-m9v6- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/neosPackagist | 1.1.0 up to 1.1.3 | 1.1.3 |
typo3/neosPackagist | 1.2.0 up to 1.2.3 | 1.2.3 |
typo3/neosPackagist | 1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2 | 1.1.3 |
typo3/neosPackagist | 1.2.0 up to 1.2.3, plus listed versions 1.2.11.2.2 | 1.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wr3c-6c22-m9v6 is a medium vulnerability (CVSS 4.9) in typo3/neos, published June 5, 2024. No source lists public exploit code. Fixed in typo3/neos 1.1.3.