Vulnerability-Lookup

WID-SEC-W-2026-0753

Vulnerability from csaf_certbund - Published: 2026-03-16 23:00 - Updated: 2026-03-17 23:00

Summary

TYPO3 Extensions: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein lokaler, oder ein enfernter authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-1323

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
TYPO3 Extension Mailqueue <0.5.2 TYPO3 / Extension		Mailqueue <0.5.2
TYPO3 Extension Mailqueue <0.4.5 TYPO3 / Extension		Mailqueue <0.4.5

CVE-2026-4202

Affected products

Known affected 3 products

Product	Identifier	Version	Remediation
TYPO3 Extension Redirect Tab <2.1.2 TYPO3 / Extension		Redirect Tab <2.1.2
TYPO3 Extension Redirect Tab <4.0.5 TYPO3 / Extension		Redirect Tab <4.0.5
TYPO3 Extension Redirect Tab <3.1.7 TYPO3 / Extension		Redirect Tab <3.1.7

CVE-2026-4208

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
TYPO3 Extension E-Mail MFA Provider TYPO3 / Extension	`cpe:/a:typo3:typo3_extension:e-mail_mfa_provider`	E-Mail MFA Provider

References

5 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler, oder ein enfernter authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuf\u00fchren, vertrauliche Informationen offenzulegen oder Sicherheitsma\u00dfnahmen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0753 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0753.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0753 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0753"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-03-16",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-005"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-03-16",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-006"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-03-16",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-007"
      }
    ],
    "source_lang": "en-US",
    "title": "TYPO3 Extensions: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-17T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-18T08:43:42.865+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0753",
      "initial_release_date": "2026-03-16T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-16T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-17T23:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-12552, EUVD-2026-12554"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Mailqueue \u003c0.5.2",
                "product": {
                  "name": "TYPO3 Extension Mailqueue \u003c0.5.2",
                  "product_id": "T051783"
                }
              },
              {
                "category": "product_version",
                "name": "Mailqueue 0.5.2",
                "product": {
                  "name": "TYPO3 Extension Mailqueue 0.5.2",
                  "product_id": "T051783-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:mailqueue__0.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Mailqueue \u003c0.4.5",
                "product": {
                  "name": "TYPO3 Extension Mailqueue \u003c0.4.5",
                  "product_id": "T051784"
                }
              },
              {
                "category": "product_version",
                "name": "Mailqueue 0.4.5",
                "product": {
                  "name": "TYPO3 Extension Mailqueue 0.4.5",
                  "product_id": "T051784-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:mailqueue__0.4.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Redirect Tab \u003c4.0.5",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab \u003c4.0.5",
                  "product_id": "T051785"
                }
              },
              {
                "category": "product_version",
                "name": "Redirect Tab 4.0.5",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab 4.0.5",
                  "product_id": "T051785-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:redirect_tab__4.0.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Redirect Tab \u003c3.1.7",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab \u003c3.1.7",
                  "product_id": "T051786"
                }
              },
              {
                "category": "product_version",
                "name": "Redirect Tab 3.1.7",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab 3.1.7",
                  "product_id": "T051786-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:redirect_tab__3.1.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Redirect Tab \u003c2.1.2",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab \u003c2.1.2",
                  "product_id": "T051787"
                }
              },
              {
                "category": "product_version",
                "name": "Redirect Tab 2.1.2",
                "product": {
                  "name": "TYPO3 Extension Redirect Tab 2.1.2",
                  "product_id": "T051787-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:redirect_tab__2.1.2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "E-Mail MFA Provider",
                "product": {
                  "name": "TYPO3 Extension E-Mail MFA Provider",
                  "product_id": "T051788",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:e-mail_mfa_provider"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Extension"
          }
        ],
        "category": "vendor",
        "name": "TYPO3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1323",
      "product_status": {
        "known_affected": [
          "T051783",
          "T051784"
        ]
      },
      "release_date": "2026-03-16T23:00:00.000+00:00",
      "title": "CVE-2026-1323"
    },
    {
      "cve": "CVE-2026-4202",
      "product_status": {
        "known_affected": [
          "T051787",
          "T051785",
          "T051786"
        ]
      },
      "release_date": "2026-03-16T23:00:00.000+00:00",
      "title": "CVE-2026-4202"
    },
    {
      "cve": "CVE-2026-4208",
      "product_status": {
        "known_affected": [
          "T051788"
        ]
      },
      "release_date": "2026-03-16T23:00:00.000+00:00",
      "title": "CVE-2026-4208"
    }
  ]
}

CVE-2026-1323 (GCVE-0-2026-1323)

Vulnerability from cvelistv5 – Published: 2026-03-17 08:33 – Updated: 2026-03-17 13:18

Title

Insecure Deserialization in extension "Mailqueue" (mailqueue)

Summary

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

Severity

5.2 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Mailqueue"	Affected: 0 , < 0.4.5 (semver) Affected: 0.5.0 , < 0.5.2 (semver)

Date Public

2026-03-17 09:00

Credits

Elias Häußler Elias Häußler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1323",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T13:18:07.208226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T13:18:18.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "cpsit/typo3-mailqueue",
          "product": "Extension \"Mailqueue\"",
          "repo": "https://github.com/CPS-IT/mailqueue",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "0.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.5.2",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Elias H\u00e4u\u00dfler"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elias H\u00e4u\u00dfler"
        }
      ],
      "datePublic": "2026-03-17T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at \u003ccode\u003e$GLOBALS[\u0027TYPO3_CONF_VARS\u0027][\u0027MAIL\u0027][\u0027transport_spool_filepath\u0027]\u003c/code\u003e."
            }
          ],
          "value": "The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS[\u0027TYPO3_CONF_VARS\u0027][\u0027MAIL\u0027][\u0027transport_spool_filepath\u0027]."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-17T08:33:05.160Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-005"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insecure Deserialization in extension \"Mailqueue\" (mailqueue)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-1323",
    "datePublished": "2026-03-17T08:33:05.160Z",
    "dateReserved": "2026-01-22T06:39:32.852Z",
    "dateUpdated": "2026-03-17T13:18:18.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4202 (GCVE-0-2026-4202)

Vulnerability from cvelistv5 – Published: 2026-03-17 08:33 – Updated: 2026-03-17 13:17

Title

Broken Access Control in extension "Redirect Tab"

Summary

The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Redirect Tabs"	Affected: 4.0.0 , < 4.0.5 (semver) Affected: 3.0.0 , < 3.1.7 (semver) Affected: 0 , < 2.1.2 (semver)

Date Public

2026-03-17 09:00

Credits

Guido Schmechel Guido Schmechel

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4202",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T13:17:25.795221Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T13:17:40.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "ayacoo/redirect-tab",
          "product": "Extension \"Redirect Tabs\"",
          "repo": "https://github.com/ayacoo/redirect_tab",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "4.0.5",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.7",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guido Schmechel"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Guido Schmechel"
        }
      ],
      "datePublic": "2026-03-17T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eThe extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.\u003c/span\u003e"
            }
          ],
          "value": "The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-17T08:33:40.968Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-006"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Broken Access Control in extension \"Redirect Tab\"",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-4202",
    "datePublished": "2026-03-17T08:33:40.968Z",
    "dateReserved": "2026-03-15T10:57:58.870Z",
    "dateUpdated": "2026-03-17T13:17:40.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4208 (GCVE-0-2026-4208)

Vulnerability from cvelistv5 – Published: 2026-03-17 08:34 – Updated: 2026-03-24 17:20

Title

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Summary

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-639

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "E-Mail MFA Provider"	Affected: 0 , ≤ 1.0.5 (semver) Affected: 2.0.0 (semver)

Date Public

2026-03-17 09:00

Credits

Jan Holtkötter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T13:16:53.008295Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T13:17:07.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "ralffreit/mfa-email",
          "product": "Extension \"E-Mail MFA Provider\"",
          "repo": "https://github.com/MrSilaz/mfa_email",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThanOrEqual": "1.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jan Holtk\u00f6tter"
        }
      ],
      "datePublic": "2026-03-17T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eThe extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.\u003c/span\u003e"
            }
          ],
          "value": "The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T17:20:39.697Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-007"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication Bypass in extension \"E-Mail MFA Provider\" (mfa_email)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-4208",
    "datePublished": "2026-03-17T08:34:52.141Z",
    "dateReserved": "2026-03-15T11:55:45.299Z",
    "dateUpdated": "2026-03-24T17:20:39.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-0753

CVE-2026-1323 (GCVE-0-2026-1323)

CVE-2026-4202 (GCVE-0-2026-4202)

CVE-2026-4208 (GCVE-0-2026-4208)

Tags

Sightings

Nomenclature