CVE-2026-47350 is a missing authorization vulnerability in TYPO3 CMS that permits backend users to move records to a different page without possessing the required edit permissions on the source page. This flaw affects TYPO3 CMS versions 13.0.0 up to 13.4.30 and 14.0.0 up to 14.3.2. The vulnerability is identified as CWE-862. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond backend user, no user interaction, and limited impact on integrity. As of the published date, no official fix or patch has been announced by TYPO3.

Unauthorized modification of content organization within TYPO3 CMS can occur, allowing backend users to move records without proper permissions. This could lead to unauthorized changes in page content structure, potentially affecting data integrity and workflow processes. However, the impact is limited to users with backend access and does not escalate to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user permissions to trusted personnel only and monitor for unusual record movement activities. Avoid granting unnecessary edit permissions to backend users to minimize risk.