CVE-2026-85400

    Dashboard / Vulnerabilities / CVE-2026-85400

    CVE-2026-85400

    Published: 8 Sept 2026Last Modified: 10 Sept 2026

    Summary: TYPO3 CMS - Missing Authorization in lowlevel commands

    Details: Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

    References: https://packagist.org, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85400.json, https://news.typo3.com/security/advisory/typo3-core-sa-2026-023, https://nvd.nist.gov/vuln/detail/CVE-2026-85400, https://github.com/TYPO3/typo3/commit/b8abe36978c63a0625aee70df078895216e7ee27, https://github.com/TYPO3/typo3/commit/e15da7ba0218532240578b471152f76c13cb4154, https://github.com/TYPO3/typo3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b8abe36978c63a0625aee70df078895216e7ee27

    Affected versions

    v14.3.6
    v14.3.5
    v14.3.4
    v14.3.3
    v14.3.2
    v14.3.1
    v14.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85400 | CVE-DB