TYPO3 14.3.7 and 13.4.35: Information Disclosure in the Localization Wizard and Missing Authorization for Configuration Commands Fixed
TYPO3 released versions 14.3.7 LTS and 13.4.35 LTS on September 8, 2026, fixing two security issues. TYPO3-CORE-SA-2026-022 (CVE-2026-77132, CVSS 5.3) describes an information disclosure in the backend localization wizard: several AJAX routes did not check authorization sufficiently. TYPO3-CORE-SA-2026-023 (CVE-2026-85400, CVSS 7.5) allows backend administrators without system-maintainer privileges to schedule configuration commands that should be reserved for maintainers.
TL;DR — 90 seconds
Two security issues, fixed in TYPO3 14.3.7 LTS and 13.4.35 LTS. SA-2026-022 (CVE-2026-77132, CVSS 5.3, medium) lets authenticated backend users with low privileges use the localization wizard to access record and content information outside their actual permission scope. SA-2026-023 (CVE-2026-85400, CVSS 7.5, high) lets backend administrators without system-maintainer privileges schedule the configuration:read, configuration:set and configuration:show scheduler commands, letting them modify system configuration that should be reserved for maintainers. Depending on the issue, affected version lines range from 10.4 to 14.3.6. Fix: 10.4.60 ELTS, 11.5.54 ELTS, 12.4.49 ELTS, 13.4.35 LTS, 14.3.7 LTS.
What is the problem?
In SA-2026-022, several AJAX routes of the backend localization wizard did not fully check the calling user's authorization. An authenticated backend user with restricted privileges could therefore retrieve information about records and content elements they should not actually have access to.
In SA-2026-023, the scheduler lacked a check restricting the scheduling of the configuration:read, configuration:set and configuration:show commands to system maintainers. A backend administrator without these elevated privileges could still create such commands as a scheduled task and thereby read or modify system configuration normally reserved for maintainers.
Who is affected?
| CVE | Advisory | Affected | Fix | CVSS |
|---|---|---|---|---|
| CVE-2026-77132 | SA-2026-022 | 10.0.0–10.4.59, 11.0.0–11.5.53, 12.0.0–12.4.48, 13.0.0–13.4.34, 14.0.0–14.3.6 | 10.4.60 / 11.5.54 / 12.4.49 / 13.4.35 / 14.3.7 | 5.3 (medium) |
| CVE-2026-85400 | SA-2026-023 | 14.2.0–14.3.6 | 14.3.7 | 7.5 (high) |
SA-2026-022 affects the entire supported version range from 10.4 ELTS to 14.3. SA-2026-023 affects only the 14.x line from 14.2.0 onward; older version lines do not use the affected scheduler-command mechanism in this form.
Impact
SA-2026-022 requires an authenticated backend account with low privileges, for example an editorial account without broad permissions. The impact stays limited to information disclosure, but potentially covers records outside the pages or languages actually assigned to that account.
SA-2026-023 requires a backend administrator account, just without the system-maintainer flag, a privilege profile that is common in practice. The impact is considerably higher: complete loss of confidentiality, integrity and availability of the system configuration, since the affected commands can read and set arbitrary configuration values.
Mitigation / Immediate actions
Update to TYPO3 14.3.7 LTS or 13.4.35 LTS. For the older, commercially maintained ELTS lines, update to 12.4.49, 11.5.54, or 10.4.60, where relevant for SA-2026-022.
Note: the update to 14.3.7 changes the behavior of scheduled tasks that previously executed configuration:read, configuration:set or configuration:show. These tasks no longer work unchanged after the update. For automated configuration changes you actually need, set up alternative execution paths, such as your own cronjobs with explicit maintainer privileges, instead of relying on the TYPO3 scheduler.
Also check which backend users currently hold administrator privileges without the system-maintainer flag, and reduce that group to what is actually necessary.
Detection / Verification
Check the TYPO3 scheduler module for scheduled tasks that execute configuration:read, configuration:set or configuration:show, and whether they were created by users without system-maintainer privileges.
Review the backend access log for unusual access by low-privileged users to the localization wizard's AJAX routes, especially access to page or language combinations outside their assigned permissions.
Operator recommendation
Act today if: you run TYPO3 14.2.0 through 14.3.6 with multiple backend administrators, not all of whom are system maintainers. Patch to 14.3.7 promptly and review existing scheduler tasks.
Monitoring is enough if: your installation runs exclusively with system maintainers as administrators, and no low-privileged backend users have access to the localization wizard. An update in the next maintenance window is still recommended, especially because of SA-2026-022.
Frequently asked questions about SA-2026-022 and SA-2026-023
Why is this security release only being covered now?+
TYPO3 14.3.7 and 13.4.35 were released on September 8, 2026. This post closes a gap in our prior coverage and summarizes both advisories after the fact.
Do I need to take both advisories equally seriously?+
Does SA-2026-023 also affect TYPO3 12 or 13?+
No. SA-2026-023 affects only the 14.x line from version 14.2.0 onward. SA-2026-022, by contrast, affects all supported lines from 10.4 ELTS to 14.3.
What happens to existing scheduler tasks after the update?+
Scheduled tasks executing configuration:read, configuration:set or configuration:show no longer work as before once you update to 14.3.7. Set up alternative, maintainer-privileged execution paths for this purpose.
Is it enough to just review administrator privileges instead of patching?+
No. Reviewing privileges reduces the risk but does not close the vulnerability. Only updating to the versions listed fully fixes both issues.
Conclusion
Both advisories follow a recurring pattern in TYPO3 security releases: missing or incomplete authorization checks in backend-adjacent functionality that looks harmless at first glance. Anyone running TYPO3 with multiple backend roles should regularly review administrator privileges and the system-maintainer flag separately, rather than treating them as equivalent.
Sources
I manage TYPO3 security updates for my clients on an ongoing basis, from version triage to a tested rollout on staging and production.
TYPO3 patch management, backend privilege and role audits, hardening of scheduler tasks.
Platform operations, not paper advice: I review, patch and harden your infrastructure on an ongoing basis.