CVE-2026-85400
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.44%
- CWE
- CWE-862, CWE-266
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- TYPO3 TYPO3 CMS
Weakness type
Related vulnerabilities
- CVE-2026-87997 — Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
- CVE-2026-87994 — Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
- CVE-2026-68484 — Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API....
- CVE-2026-86765 — Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
- CVE-2026-86764 — Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
- CVE-2026-86762 — Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
- CVE-2026-86759 — Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
- CVE-2026-86757 — Snipe-IT before 8.7.0 Information Disclosure via Custom Fields