CVE-2026-85400: 
PHP vulnerability analysis and mitigation

CVE-2026-85400 is a missing authorization / incorrect privilege assignment vulnerability in TYPO3 CMS that allows backend administrators without system maintainer privileges to schedule configuration:read, configuration:set, and configuration:show CLI commands via the scheduler module. This enables them to read, modify, or remove arbitrary system configuration — actions normally restricted to system maintainers — and can result in privilege escalation or denial of service. The vulnerability affects TYPO3 CMS versions 14.2.0 through 14.3.6 (package typo3/cms-lowlevel). It was published on September 8, 2026, and carries a CVSS v4.0 base score of 7.5 (High) (TYPO3 Advisory, GitHub Commit).

The root cause is that the three configuration:* CLI commands (configuration:remove, configuration:set, configuration:show) in the typo3/sysext/lowlevel extension were never decorated with the #[AsNonSchedulableCommand] attribute, meaning TYPO3's scheduler module did not restrict their execution to system maintainers (CWE-862: Missing Authorization; CWE-266: Incorrect Privilege Assignment). Any backend administrator account — a lower-privilege role — could schedule these commands through the TYPO3 Scheduler module's web interface, bypassing the access control that normally gates direct CLI execution of configuration management commands to system maintainers. The fix adds the #[AsNonSchedulableCommand] PHP attribute to all three command classes, preventing them from being registered or executed via the scheduler (GitHub Commit, GitHub Commit 2).

A malicious or compromised backend administrator can exploit this vulnerability to read sensitive system configuration values (e.g., database credentials, encryption keys), modify arbitrary configuration settings (e.g., granting themselves system maintainer privileges), or corrupt configuration in a way that causes a denial of service. The vulnerability has a total technical impact per NVD SSVC assessment, with high confidentiality, integrity, and availability impacts on the vulnerable system. While exploitation is limited to authenticated backend administrator accounts, successful exploitation could lead to full TYPO3 instance compromise and potential lateral movement within the hosting environment (TYPO3 Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable (requires an authenticated administrator-level backend account), which significantly limits the attack surface. The EPSS score is approximately 0.0044 (0.44%), reflecting a low probability of near-term exploitation (Feedly).

1. Obtain backend administrator access: Acquire credentials for a TYPO3 backend user account with administrator privileges (but without system maintainer status) — e.g., through phishing, credential stuffing, or insider access.
2. Navigate to the Scheduler module: Log into the TYPO3 backend and open the Scheduler module, which is accessible to backend administrators.
3. Create a new scheduler task: Add a new scheduler task and select one of the configuration:* CLI commands (configuration:read, configuration:set, or configuration:show) from the available command list.
4. Configure the payload: For privilege escalation, configure configuration:set with parameters that grant the attacker's account system maintainer privileges or modify security-relevant settings (e.g., authentication configuration).
5. Execute the task: Trigger the scheduled task immediately or wait for the next scheduled execution. The command runs with system-level configuration access, bypassing the system maintainer restriction.
6. Achieve objective: Read sensitive configuration values (credentials, keys), escalate to system maintainer, or corrupt configuration to cause denial of service (GitHub Commit, TYPO3 Advisory).

• Logs: TYPO3 scheduler execution logs showing configuration:set, configuration:remove, or configuration:show tasks created or run by non-system-maintainer backend user accounts; unexpected changes to system/settings.php timestamps.
• File System: Unexpected modifications to typo3conf/system/settings.php or equivalent configuration files outside of normal deployment windows.
• Application: New or unexpected scheduler tasks of type configuration:* visible in the TYPO3 Scheduler module backend; backend user accounts that were not previously system maintainers suddenly gaining system maintainer status.
• Database: Audit log entries (if TYPO3 audit logging is enabled) recording scheduler task creation or modification by administrator-level accounts for configuration commands.

TYPO3 has released version 14.3.7 of typo3/cms-lowlevel which applies the #[AsNonSchedulableCommand] attribute to all three configuration:* commands, preventing their use via the scheduler module. Administrators should upgrade to TYPO3 CMS 14.3.7 or later immediately. As a post-upgrade step, any existing scheduler tasks using configuration:* commands should be identified and removed, as they will no longer function; if automated configuration management is required, it should be performed via CLI cronjobs instead (TYPO3 Advisory, GitHub Commit).

The vulnerability was disclosed by TYPO3 via their official security advisory (TYPO3-CORE-SA-2026-023) on September 8, 2026, with patches committed by Elias Häußler and reviewed by Benjamin Franzke. Automated vulnerability tracking services including VulDB, CIRCL, and INCIBE-CERT picked up the disclosure shortly after publication. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database aggregation (TYPO3 Advisory).