CVE-2026-6553

CVE-2026-6553 is a password storage vulnerability affecting TYPO3 CMS version 14.2.0, wherein changing backend user passwords through the user settings module results in cleartext password storage in the uc and user_settings database fields. This represents a critical flaw in credential management that could expose sensitive authentication data. The vulnerability carries a FAUCET Risk Score of 47.0/100, indicating moderate concern. While specific CVSS vector details are unavailable, the core issue involves improper password handling at the application level, likely requiring administrative access to the backend user settings module to trigger the vulnerability, which may limit initial attack surface. Current exploitation activity appears minimal, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on threat intelligence platforms. The exceptionally low EPSS score of 0.00029 suggests negligible real-world exploitation likelihood at this time. However, the vulnerability warrants prompt patching given its direct impact on credential confidentiality and the ease with which an authenticated attacker could trigger password exposure.