Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-setup

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.8PackagistPublished

    TYPO3 Unverified Password Change for Backend Users

    CVE-2025-47938 · GHSA-3jrg-97f3-rqh9

    Affected
    • Packagist typo3/cms-setup >= 9.0.0, <= 9.5.50; >= 10.0.0, <= 10.4.49; >= 11.0.0, <= 11.5.43; >= 12.0.0, <= 12.4.30; >= 13.0.0, <= 13.4.11
    Fixed in
    13.4.129.5.5110.4.5011.5.4412.4.31· Vendor fix available
    Issue
    Problem The backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower the protection against unauthorized access in scenarios where an admin session is hijacked or left unattended, as it enables password changes without additional authentication. Solution Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described. [!NOTE] In these versions, administrators are required to verify their identity through step-up authentication (also known as sudo mode) when changing backend user passwords. Credits Thanks to the National Cyber Security Center (NCSC) of Switzerland for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.

    Recommended action: Upgrade to 13.4.12, 12.4.31, 11.5.44 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →