Listen to this Post
This vulnerability is a Broken Access Control issue within the TYPO3 backend ‘redirects’ module (sys_redirect). The flaw resides in inadequate permission checks during CRUD operations on redirect records. Backend users who are granted module access and write permissions for the sys_redirect table were not constrained by file-mount or web-mount boundaries. The system failed to verify if a user’s assigned mounts corresponded to the source or target paths of a redirect being accessed or manipulated. Consequently, an authenticated attacker with these specific privileges could perform unauthorized actions: read any existing redirect, create new redirects pointing to malicious external domains, or modify existing legitimate redirects to point to attacker-controlled resources. This bypass of intended mount restrictions enables the injection of malicious redirects, facilitating phishing campaigns or other client-side attacks when site visitors follow the compromised links.
Platform: TYPO3 CMS
Version: 10.4.0-14.0.1
Vulnerability: Broken Access Control
Severity: Moderate
date: 2026-01-13
Prediction: Patch released 2026-01-13
What Undercode Say:
`typo3/cms-core:14.0.1`
`composer show typo3/cms-core`
`vendor/bin/typo3 database:compare`
`SELECT FROM sys_redirect;`
`UPDATE sys_redirect SET target=’http://evil.com’;`
How Exploit:
1. Attacker gains backend access.
2. Attacker navigates to redirects module.
3. Attacker creates/modifies a redirect record.
4. Sets target to phishing URL.
5. Saves record unrestricted.
Protection from this CVE
Update to patched versions: 10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2.
Review backend user permissions.
Apply principle of least privilege.
Impact:
Phishing attack facilitation.
Malicious redirect injection.
Unauthorized data modification.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
