Privilege Escalation in TYPO3 Neos
Date: 2024-06
Affected: composer/typo3/neos, composer/typo3/neos
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVSS: 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors.


Mitigations:

Architectural layers (MAESTRO):