CVE-2026-6553

Problem

The backend user settings module (SetupModuleController) incorrectly conflates entity data (like passwords or email address) with user-interface settings (like theme, display options) when persisting changes. As a result, passwords were stored in cleartext in the uc and user_settings fields of the be_users database table.

The cleartext data was only persisted if users changed their credentials in the backend user settings module when the TYPO3 14.2.0 release was used (not in any other version).

Credits

TYPO3 thanks Martin Clewing for reporting this issue, and TYPO3 core team members Oliver Hader, Stefan Bürk and Garvin Hicking for fixing it.

CVE-2026-6553 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (14.3.0); upgrading removes the vulnerable code path.

Kodem intelligence

Update to TYPO3 version 14.3.0 LTS which fixes the problem described.

[!IMPORTANT]
Manual actions required

Updating to the patched release does not retroactively clean existing data. It is recommended to execute all User Settings upgrade wizards in the TYPO3 Install Tool, including the dedicated User Settings Scrubbing wizard, which sanitizes the incorrectly persisted cleartext values from the uc and user_settings fields of the be_users table. Additionally, affected backend user accounts should be assigned new passwords.

Admin Tools → Upgrade → Upgrade Wizard → User Settings Scrubbing

1. What is CVE-2026-6553? CVE-2026-6553 is a high-severity security vulnerability in typo3/cms-backend (composer), affecting versions = 14.2.0. It is fixed in 14.3.0.
2. How severe is CVE-2026-6553? CVE-2026-6553 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of typo3/cms-backend are affected by CVE-2026-6553? typo3/cms-backend (composer) versions = 14.2.0 is affected.
4. Is there a fix for CVE-2026-6553? Yes. CVE-2026-6553 is fixed in 14.3.0. Upgrade to this version or later.
5. Is CVE-2026-6553 exploitable, and should I be worried? Whether CVE-2026-6553 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-6553 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-6553? Upgrade typo3/cms-backend to 14.3.0 or later.