CVE-2023-50461

The direct_mail (Direct Mail) extension for TYPO3, through version 9.5.1, contains an authorization flaw (CWE-863) in its Configuration backend module that allows an authenticated backend user with access to that module to write to the TSConfig of an arbitrary page, not just the Direct Mail folders they should be able to manage. The flaw is triggered simply by saving configuration through the module while targeting an arbitrary page, bypassing the intended restriction. Impact depends on the TYPO3 core version: on TYPO3 10.4 and above, this yields configuration injection, while on TYPO3 9.5 and below it can escalate to arbitrary code execution, which is why the issue carries a high CVSS 3.1 score of 8.8. Affected installations are TYPO3 sites running direct_mail 9.5.1 or earlier where backend users — including low-privileged accounts — have been granted access to the Direct Mail Configuration module. No public proof-of-concept is known, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade the direct_mail extension to a release newer than 9.5.1 (the latest available version) as soon as possible. Restrict backend user/group access to the Direct Mail Configuration module to only those who genuinely need it, since exploitation requires such access, and audit pages' TSConfig records for unauthorized modifications. Prioritize remediation on sites still running TYPO3 9.5 or below, which is itself end-of-life, because there the flaw can lead to arbitrary code execution.