CVE-2026-6553 - TYPO3 CMS Stores Cleartext Password in User Settings Module

Back Back to CVE browser

HIGH

TYPO3 CMS Stores Cleartext Password in User Settings Module

Published Apr 21, 2026

7.3

HIGH

CVSS 4.0

EPSS 0.27%

Description

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

Affected products

Vendor TYPO3 Product Typo3 Cms Default
unaffected
- Version
  14.2.0
  Status
  affected
  Constraints
  <14.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TYPO3

Typo3 Cms

unaffected

Version	Status	Constraints
14.2.0	affected	<14.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-312

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24081
Advisory
https://github.com/TYPO3/typo3/commit/9a6e913f70767f63b322ae3e2d2f4e302624c291
patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-xvv6-p4wf-mvx7
https://github.com/advisories/GHSA-xvv6-p4wf-mvx7
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6553
https://typo3.org/security/advisory/typo3-core-sa-2026-005
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24081		Advisory
https://github.com/TYPO3/typo3/commit/9a6e913f70767f63b322ae3e2d2f4e302624c291		patch
https://github.com/TYPO3/typo3/security/advisories/GHSA-xvv6-p4wf-mvx7
https://github.com/advisories/GHSA-xvv6-p4wf-mvx7		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6553
https://typo3.org/security/advisory/typo3-core-sa-2026-005		vendor-advisoryVendor Advisory