TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

PKSA-hf64-fs5s-6k3h CVE-2026-19418

Affected package: typo3/cms-core

Affected version: >=13.0.0,<13.4.34|>=14.0.0,<14.3.6

Reported by:
FriendsOfPHP/security-advisories