Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-6553

TYPO3 CMS Stores Cleartext Password in User Settings Module

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 TYPO3 CMS

Default version status: unaffected

  • 14.2.0 to < 14.3.0affected

References