CVE-2026-47352 is a missing authorization vulnerability in TYPO3 CMS where authenticated backend users can access file metadata through Backend API routes without adequate permission validation. This flaw permits users to access files beyond their authorized file mounts or storage areas. The vulnerability impacts TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2. No official remediation level or patch links are provided in the data, and no known exploits in the wild have been reported.

Authenticated backend users can bypass intended permission restrictions to retrieve metadata of files outside their authorized file mounts or storage locations. This could lead to unauthorized disclosure of file metadata, potentially exposing sensitive information about the file system structure or contents accessible to the backend user. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official remediation level is provided, users should monitor TYPO3 vendor communications for updates and apply any forthcoming security updates promptly. Until a fix is available, restrict backend user permissions to minimize exposure.