Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-recycler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PackagistPublished

    TYPO3 CMS has Broken Access Control in the Recycler Module

    CVE-2026-47349 · GHSA-f34x-rx2w-7pm3

    Affected
    • Packagist typo3/cms-recycler < 10.4.57; >= 11.0.0, < 11.5.51; >= 12.0.0, < 12.4.46; >= 13.0.0, < 13.4.31; >= 14.0.0, < 14.3.3
    Fixed in
    11.5.5113.4.3110.4.5712.4.4614.3.3· Vendor fix available
    Issue
    Problem Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team member Elias Häußler for fixing it. Resources TYPO3-CORE-SA-2026-011

    Recommended action: Upgrade to 14.3.3, 13.4.31, 12.4.46 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.1PackagistPublished

    TYPO3 CMS Allows Broken Access Control in Recycler Module

    CVE-2025-59022 · GHSA-p52w-7rhw-9m67

    Affected
    • Packagist typo3/cms-recycler >= 14.0.0, <= 14.0.1; >= 13.0.0, <= 13.4.22; >= 12.0.0, <= 12.4.40; >= 11.0.0, <= 11.5.48; >= 10.0.0, <= 10.4.54
    Fixed in
    11.5.4910.4.5513.4.2314.0.212.4.41· Vendor fix available
    Issue
    Problem Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. Credits Thanks to Sven Jürgens and Daniel Windloff for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. References TYPO3-CORE-SA-2026-003

    Recommended action: Upgrade to 14.0.2, 13.4.23, 12.4.41 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →