Medium severity · published Jun 9, 2026
CVE-2026-47351
TYPO3 CMS - Broken Access Control in Clipboard
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TYPO3 CMS · TYPO3
10.4.0 before 13.4.31; 14.0.0 before 14.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47351
github.com
https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3
github.com
https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451
typo3.org
https://typo3.org/security/advisory/typo3-core-sa-2026-014
More from TYPO3 CMS
8.7
CVE-2026-49741
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
7.6
CVE-2026-47346
TYPO3 CMS - Broken Access Control in Form Framework
7.6
CVE-2026-11607
TYPO3 CMS - Broken Access Control in Form Framework
7.5
CVE-2026-85400
TYPO3 CMS - Missing Authorization in lowlevel commands
7.5
CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module