Listen to this Post
The vulnerability exists within the Recycler module’s data deletion functionality. TYPO3 uses a Table Configuration Array (TCA) to define database tables and enforce backend user permissions for each. The flawed module code failed to validate if a user had explicit delete rights for a specific table before executing the deletion SQL query. When a backend user with access to the Recycler module initiated a purge action, the module would accept a user-controlled table name parameter. It directly used this parameter to construct and execute a `DELETE` SQL statement against the specified database table, bypassing all TCA-based permission checks. This allowed a user to delete records from any core or custom table defined in the system’s TCA, such as pages, tt_content, or user data tables, leading to complete data destruction.
Platform: TYPO3 CMS
Version: 10.4.0-14.0.1
Vulnerability: Broken Access Control
Severity: Critical
Date: 2026-01-13
Prediction: 2026-01-13
What Undercode Say:
composer show 'typo3/cms-core' | grep versions
// Example vulnerable logic path
$table = GeneralUtility::_GP('table');
$queryBuilder->delete($table)->execute();
How Exploit:
Attacker with backend Recycler access sends crafted HTTP request specifying target table name, causing irreversible data deletion.
Protection from this CVE:
Update to patched versions (10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2). Restrict backend module access.
Impact:
Arbitrary data deletion, site destruction, denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
