---
title: "GHSA-gwfx-p7mr-f92v: Missing Access Check in TYPO3 CMS"
url: https://erroneo.us/security/ghsa/GHSA-gwfx-p7mr-f92v/
description: "GHSA-gwfx-p7mr-f92v (critical, Composer (PHP)): Missing Access Check in TYPO3 CMS. Extbase request handling fails to implement a proper access check for…"
type: advisory
section: "Security Digest"
date_published: 2024-06-05
date_modified: 2024-06-05
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-gwfx-p7mr-f92v"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-gwfx-p7mr-f92v: Missing Access Check in TYPO3 CMS

## Affected packages

- Composer (PHP) `typo3/cms` >= 6.2.0, < 6.2.25 → fixed: 6.2.25
- Composer (PHP) `typo3/cms` >= 7.6.0, < 7.6.8 → fixed: 7.6.8
- Composer (PHP) `typo3/cms` >= 8.0.0, < 8.1.1 → fixed: 8.1.1

## Details

Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.

## Sources

- [GitHub Advisory GHSA-gwfx-p7mr-f92v](https://github.com/advisories/GHSA-gwfx-p7mr-f92v)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-05-24-1.yaml)
- [web.archive.org](https://web.archive.org/web/20160606110438/https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms)

---
Source page: https://erroneo.us/security/ghsa/GHSA-gwfx-p7mr-f92v/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt