Missing Permission Check for System Commands
The vulnerability affects the system configuration of the TYPO3 extension lowlevel. Backend users with administrator rights, but without the System Maintainer role, could execute certain configuration commands via the TYPO3 Scheduler.
The affected commands were:
configuration:readconfiguration:setconfiguration:show
This allowed such users to change any system-wide setting. In the worst case, it was possible to grant oneself System Maintainer rights or to impair the availability of the TYPO3 installation.
However, an attack already requires a backend user account with administrator rights. The vulnerability is therefore not exploitable without prior access to the TYPO3 backend.
Which TYPO3 Versions Are Affected?
According to the TYPO3 Security Team, the following versions are affected by the vulnerability tracked as CVE-2026-85400:
TYPO3 14.2.0 through TYPO3 14.3.6 inclusive
The vulnerability was fixed in TYPO3 14.3.7 LTS. Its severity is rated as high.
What Should You Do Now?
Operators of an affected TYPO3 installation should update to TYPO3 14.3.7 LTS as soon as possible. No additional database migration is required after the update. However, TYPO3 recommends running the Database Analyzer afterwards, as the new version also includes optimizations to the database structure.
In addition, existing scheduler tasks should be reviewed: tasks that execute one of the configuration:* commands mentioned above will no longer work after the security update. Automated changes to the system configuration must be implemented differently going forward – for example via a custom-configured cron job.
Our Recommendation
Even though exploitation already requires a privileged backend account, the risk should not be underestimated. Especially for installations with multiple administrators or external service providers, the missing permission check can have significant consequences.
We therefore recommend: