CVE-2026-77132: 
PHP vulnerability analysis and mitigation

CVE-2026-77132 is a missing authorization vulnerability in TYPO3 CMS affecting the backend localization wizard's AJAX endpoints. Several AJAX routes — specifically getRecord(), getHandlers(), getContent(), and localize() in the Wizard localization controller, as well as getUsedLanguagesInPage(), getRecordLocalizeSummary(), and localizeRecords() in the Page localization controller — failed to perform page-level authorization checks, allowing authenticated low-privileged backend users to access records and content elements outside their permitted scope. Affected versions span TYPO3 CMS 10.0.0–10.4.59, 11.0.0–11.5.53, 12.0.0–12.4.48, 13.0.0–13.4.34, and 14.0.0–14.3.6. The vulnerability was disclosed on September 8, 2026, under security bulletin TYPO3-CORE-SA-2026-022, and carries a CVSS v4.0 base score of 5.3 (Medium) (TYPO3 Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization) combined with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Of the seven localization wizard AJAX endpoints, only getModes(), getTargets(), and getSources() verified that the backend user had access to the page a record resides on; getRecord(), getHandlers(), getContent(), and localize() performed no such check and responded to any authenticated backend user. Similarly, the Page localization controller's getUsedLanguagesInPage() and getRecordLocalizeSummary() endpoints disclosed page languages, content record titles, UIDs, and backend layout columns without verifying page access. The fix adds hasLocalizationAccess() and hasPageAccess() checks using BackendUtility::readPageAccess() with the user's PAGE_SHOW permission clause to all affected endpoints, returning HTTP 403 for unauthorized requests (GitHub Commit c232421, GitHub Commit 1c63ce8).

Successful exploitation allows a low-privileged, authenticated TYPO3 backend user to enumerate records, content element titles, UIDs, backend layout columns, and language information for pages they are not authorized to access. The impact is limited to confidentiality — integrity and availability are not directly affected, as the vulnerability does not grant write access beyond what DataHandler already enforces. There is no evidence of lateral movement or remote code execution potential; the risk is primarily unauthorized information disclosure within the CMS backend (Feedly, GitHub Commit 1c63ce8).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The vulnerability requires an authenticated backend user account with at least low-level privileges, making unauthenticated exploitation impossible. The EPSS score is approximately 0.0041 (0.41%), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. CVE-2026-77132 is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Obtain a low-privileged backend account: Gain access to a TYPO3 backend user account with minimal permissions (e.g., an editor account restricted to specific page trees).
2. Identify target records: Determine the UIDs of records or pages outside the attacker's permitted scope (e.g., via enumeration or prior knowledge of the CMS structure).
3. Call unprotected AJAX endpoints: Send authenticated HTTP GET requests to the localization wizard AJAX endpoints such as wizard_localization_get_record, wizard_localization_get_handlers, wizard_localization_get_content, or the page localization endpoints (getUsedLanguagesInPage, getRecordLocalizeSummary), supplying the target recordUid, recordType, or pageId as query parameters.
4. Extract sensitive information: Parse the JSON responses to obtain record titles, UIDs, backend layout column assignments, available languages, and content element metadata for pages the attacker should not be able to view.
5. Optionally trigger localization: Call the localize() or localizeRecords() endpoint with the gathered parameters to attempt unauthorized localization actions (DataHandler provides a secondary barrier for writes) (GitHub Commit c232421, GitHub Commit 1c63ce8).

• Network: Unusual authenticated HTTP GET requests to TYPO3 backend AJAX endpoints such as wizard_localization_get_record, wizard_localization_get_handlers, wizard_localization_get_content, wizard_localization_get_modes, or equivalent page localization endpoints with pageId or recordUid values outside the user's normal page tree.
• Logs: TYPO3 backend access logs showing repeated requests to localization AJAX routes from a single low-privileged user account, particularly targeting page or record UIDs not associated with that user's assigned mount points.
• Logs: HTTP 200 responses to localization AJAX requests for pages that should return 403 (on unpatched systems), indicating successful unauthorized data retrieval.
• Behavior: A backend user account accessing localization wizard steps for content on pages not visible in their page tree, or unusual patterns of localization wizard activity from accounts with restricted permissions.

TYPO3 has released patched versions addressing this vulnerability: 10.4.60, 11.5.54, 12.4.49, 13.4.35, and 14.3.7. Administrators should upgrade to the appropriate fixed version as soon as possible. No configuration-based workaround is available; the only effective remediation is applying the security update. Restricting backend access to trusted users only can reduce exposure in the interim (TYPO3 Advisory, GitHub Commit c232421).