CVE-2026-47352 is a missing authorization vulnerability in TYPO3 CMS that allows authenticated backend users to access file metadata through several Backend API routes without adequate permission verification. This flaw enables users to access files beyond their assigned file mounts or storage areas. The vulnerability affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.51, 12.0.0 through 12.4.46, 13.0.0 through 13.4.31, and 14.0.0 through 14.3.3. No official remediation level or patch links are provided in the available data, and no known exploits in the wild have been reported.

Authenticated backend users can bypass intended access controls to retrieve metadata of files outside their permitted file mounts or storages, potentially exposing sensitive file information. The impact is limited to users with backend access and does not allow privilege escalation or remote unauthenticated exploitation based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated, administrators should monitor TYPO3 vendor communications for updates and consider restricting backend user permissions as a precaution until a patch is available.