CVE-2026-4202: 
PHP vulnerability analysis and mitigation

CVE-2026-4202 is a missing authorization vulnerability in the TYPO3 extension "Redirect Tab" (EXT:redirect_tab) by ayacoo that allows authenticated users to access redirect records without proper permission validation. The extension fails to verify whether an authenticated user has the necessary permissions to view redirect configurations when editing a page, resulting in unauthorized exposure of redirect records. Affected versions include redirect_tab below 2.1.2, 3.0.0–3.1.7 (fixed in 3.1.7), and 4.0.0–4.0.5 (fixed in 4.0.5). It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (TYPO3 Advisory, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When an authenticated user edits a page in the TYPO3 backend, the extension does not enforce permission checks to determine whether that user is authorized to view associated redirect records, allowing them to read redirect configurations they should not have access to. The attack vector is network-based, requires low privileges (a valid TYPO3 backend account), no user interaction, and low attack complexity, though some attack requirements are present per the CVSS v4.0 assessment (TYPO3 Advisory, ENISA EUVD).

Successful exploitation results in unauthorized read access to redirect records stored within the TYPO3 instance, impacting confidentiality with no effect on integrity or availability. An attacker with a low-privileged TYPO3 backend account could enumerate internal routing configurations, sensitive redirect URLs, and potentially discover internal application structure or hidden endpoints. The scope is limited to the affected TYPO3 installation and does not directly enable lateral movement or code execution (TYPO3 Advisory, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-4202. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (TYPO3 Advisory).

1. Reconnaissance: Identify a TYPO3 instance with the redirect_tab extension installed and running a vulnerable version (below 2.1.2, 3.0.0–3.1.7, or 4.0.0–4.0.5).
2. Authentication: Log in to the TYPO3 backend with any valid low-privileged user account.
3. Navigate to page editing: Open the page editing interface for any page within the TYPO3 backend.
4. Access redirect records: Observe that the Redirect Tab within the page editor displays redirect records associated with the page, without the extension verifying whether the current user has permission to view those records.
5. Enumerate redirect configurations: Read and record exposed redirect records, including source paths, target URLs, and any internal routing details that may reveal sensitive application structure (TYPO3 Advisory).

• Logs: TYPO3 backend access logs showing a low-privileged user account repeatedly accessing page editing views across multiple pages in a short timeframe, potentially indicating enumeration of redirect records.
• Logs: Unusual backend activity from accounts that do not normally perform page editing operations, particularly accessing pages outside their typical scope.
• Network: Repeated HTTP requests to TYPO3 backend page editing endpoints (e.g., /typo3/index.php with page edit parameters) from a single authenticated session with no corresponding legitimate editorial activity.

Administrators should update the redirect_tab extension to the patched versions: 2.1.2 (for the 2.x branch), 3.1.7 (for the 3.x branch), or 4.0.5 (for the 4.x branch). No configuration-based workaround is documented; upgrading to a fixed version is the recommended and primary remediation. As an interim measure, restricting backend access to trusted users only and auditing backend user permissions can reduce exposure risk (TYPO3 Advisory).

The vulnerability was assigned and disclosed by the TYPO3 security team via their official advisory system (TYPO3-EXT-SA-2026-006), published on March 17, 2026. No significant researcher commentary, social media discussion, or notable media coverage has been identified beyond standard vulnerability database indexing (TYPO3 Advisory, ENISA EUVD).