CVE-2026-19418: 
Typo3 Analyse et atténuation des vulnérabilités

CVE-2026-19418 is an origin validation error and CSRF vulnerability in TYPO3 CMS that allows attackers with JavaScript execution capability on the TYPO3 instance's domain to invoke backend and Install Tool endpoints with the privileges of an authenticated victim's session. The flaw was introduced in TYPO3 v13.0 when the backend and Install Tool were moved to be served from the site's main entry script (/index.php) rather than the dedicated typo3/ directory, rendering the referrer enforcement originally introduced by TYPO3-CORE-SA-2020-006 (CVE-2020-11069) ineffective. Affected versions are TYPO3 CMS 13.0.0–13.4.33 and 14.0.0–14.3.5 (packages typo3/cms-backend, typo3/cms-core, and typo3/cms-install). It was disclosed on August 11, 2026, with a CVSS v4.0 base score of 7.3 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-346 (Origin Validation Error) and CWE-352 (Cross-Site Request Forgery). The ReferrerEnforcer class in TYPO3 core determined whether a request was same-origin by comparing the HTTP Referer header against the directory of the entry script. Since TYPO3 v13.0 (issue #87889) moved the backend and Install Tool to be served from /index.php at the site root, the directory comparison resolved to the site root itself — meaning any request originating from any page on the same domain was incorrectly classified as TYPE_REFERRER_SAME_ORIGIN. An attacker who can execute JavaScript on any page of the TYPO3 instance's domain (e.g., via a stored or reflected XSS vulnerability) can issue Fetch/XHR requests to backend routes and Install Tool endpoints, which will be accepted as same-origin because the Referer header will match the site root. The fix refactors ReferrerEnforcer into an abstract class with application-specific resolveReferrerType() implementations that compare the referrer against the concrete backend entry point URI (e.g., /typo3/) rather than the generic request directory (TYPO3 Commit ae0abd3, TYPO3 Commit 4a75e86).

Successful exploitation allows an attacker with JavaScript execution on the TYPO3 instance's domain to invoke privileged backend and Install Tool endpoints using an authenticated victim's session credentials, effectively bypassing referrer-based CSRF protection. This can result in unauthorized administrative actions including content modification, user management changes, configuration tampering, and potential full compromise of the TYPO3 installation depending on the victim's privilege level. The CVSS v4.0 assessment rates confidentiality, integrity, and availability impacts on the vulnerable system as all High, reflecting the potential for total technical impact (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first achieve JavaScript execution on one of the TYPO3 instance's own domains (e.g., via a separate XSS vulnerability) and then have an authenticated backend or Install Tool user visit a page where the malicious script runs. The EPSS score is approximately 0.0021 (0.21%), indicating a low probability of exploitation in the near term (Feedly).

1. Identify a target TYPO3 instance: Confirm the target is running TYPO3 CMS 13.0.0–13.4.33 or 14.0.0–14.3.5 by inspecting HTTP response headers, page source, or using tools like Wappalyzer.
2. Find an XSS vector: Identify a cross-site scripting vulnerability on any page served from the same domain as the TYPO3 backend (e.g., a frontend page, a form, or a third-party extension output).
3. Craft a malicious payload: Write JavaScript that uses the Fetch API or XMLHttpRequest to send requests to TYPO3 backend routes or Install Tool endpoints. Because the Referer header will automatically be set to the current page's URL (on the same domain), the flawed referrer check will classify it as same-origin.
4. Deliver the payload: Inject or host the malicious JavaScript so that an authenticated TYPO3 backend user (or Install Tool user) executes it in their browser — for example, via a stored XSS in a content element or a phishing link to a reflected XSS endpoint.
5. Invoke privileged endpoints: The script issues Fetch/XHR requests (e.g., fetch('/typo3/ajax/...')) with the victim's session cookies automatically included by the browser, performing administrative actions such as creating admin accounts, modifying content, or altering configuration with the victim's privileges (Github Advisory, TYPO3 Commit ae0abd3).

• Logs: Unexpected or anomalous HTTP requests to TYPO3 backend AJAX routes (e.g., /typo3/ajax/, /typo3/module/) with a Referer header pointing to a frontend page rather than the backend itself; Install Tool endpoint requests with a frontend page as referrer.
• Logs: TYPO3 backend access logs showing administrative actions (user creation, configuration changes, content modifications) performed during sessions where the referrer is a frontend URL.
• Network: Fetch/XHR requests from a browser session to backend API endpoints originating from frontend page contexts, identifiable via browser developer tools or proxy logs.
• Application: Unexpected new backend user accounts, modified site configurations, or altered content records that do not correspond to known administrator activity.

Update TYPO3 CMS to version 13.4.34 or later (for the 13.x branch) or 14.3.6 or later (for the 14.x branch), which contain the corrected ReferrerEnforcer implementation (Github Advisory, TYPO3 Advisory). As interim mitigations, implement SameSite=Strict or SameSite=Lax cookie attributes to restrict cross-site request capabilities, deploy Content Security Policy headers to limit script execution sources, and audit all frontend extensions and content for XSS vulnerabilities that could serve as the initial attack vector. Restricting backend access to trusted IP ranges via web server configuration can also reduce exposure.