highCVE-2026-19418Sep 1, 2026

CVE-2026-19418: TYPO3 CMS Backend Broken Referrer Enforcement Allows CSRF via XSS

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A misconfigured referrer check in TYPO3 13.x lets any JavaScript running on the same domain silently call protected backend and Install Tool endpoints using a logged-in user's session.

Packagetypo3/cms-backend
Ecosystemcomposer
Affected>= 13.0.0, < 13.4.34
Fixed in13.4.34
CVE-2026-19418: TYPO3 CMS Backend Broken Referrer Enforcement Allows CSRF via XSS

The problem

TYPO3 v13.0 moved the backend and Install Tool to the site's main entry script (/index.php) instead of the old dedicated /typo3/ directory. The ReferrerEnforcer class still validated the Referer header by comparing it against the entry script's directory, which was now the site root.

This meant any request carrying a Referer of https://example.org/ (a plain frontend page) satisfied the check. Backend routes and Install Tool endpoints were therefore reachable from any same-domain script, including one injected via XSS. An attacker with JavaScript execution on the domain could forge state-changing requests with the victim's active session.

Proof of concept

A working proof-of-concept for CVE-2026-19418 in typo3/cms-backend, with the exact payload below.

javascript
// Attacker-controlled JS running on https://example.org/ (same domain as TYPO3 backend)
// The browser automatically sends Referer: https://example.org/ which the
// broken ReferrerEnforcer accepts as TYPE_REFERRER_SAME_ORIGIN.
fetch('/typo3/ajax/backend-user-password-change', {
  method: 'POST',
  credentials: 'include',          // sends the victim's backend session cookie
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    // Referer is set automatically by the browser to https://example.org/
    // Old check: dirname(entry_script) == '/' -> referrer prefix '/' -> PASS
  },
  body: 'newPassword=Pwned1337!&newPasswordConfirm=Pwned1337!&token=<csrf_token_from_dom>'
});

The root cause (CWE-346 Origin Validation Error) is in ReferrerEnforcer::assertReferrer(). It built the expected referrer prefix from dirname() of the entry script path. After the v13.0 architectural change, that path resolved to /, so every same-domain referrer, including one from a public frontend page, was accepted as same-origin.

The patch (commits 4a75e862, a0e8ee06, ae0abd32) replaces the directory-based heuristic with explicit, application-specific URI paths: the backend now requires the referrer to begin with /typo3/ and the Install Tool with /typo3/install.php. Requests arriving from the site root or any frontend path are rejected.

The fix is purely server-side; no CSP or SameSite cookie changes are required.

Exploitation chains through XSS, since modern browsers enforce SameSite=Strict for backend cookies by default. An attacker needs an existing XSS on the TYPO3 instance's domain and a logged-in victim to call arbitrary backend AJAX endpoints.

The fix

Upgrade to TYPO3 13.4.34 LTS or 14.3.6 LTS. No configuration change is needed alongside the upgrade. If immediate patching is impossible, ensure no XSS vectors exist on any page served from the same origin as the backend, and verify security.backend.enforceReferrer is enabled (it is on by default).

Reported by Ho Cao Tu.

References: [1][2][3][4][5][6]

Related research