GitHub Advisoryadvisory · Packagist

GHSA-2fhw-2j7m-mr4m TYPO3 backend modules have Broken Access Control

MEDIUM Published 2025-09-09 Modified 2025-09-09 Official page ↗
Aliases
CVE-2025-59017
Ecosystem
Packagist
Packages
typo3/cms-workspaces, typo3/cms-recycler, typo3/cms-dashboard, typo3/cms-beuser, typo3/cms-backend
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-09-09

Affected packages

• Packagist typo3/cms-workspaces: >= 9.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-workspaces: >= 10.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-workspaces: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-workspaces: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-workspaces: >= 13.0.0, < 13.4.18 → fixed in 13.4.18 • Packagist typo3/cms-recycler: >= 9.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-recycler: >= 10.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-recycler: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-recycler: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-recycler: >= 13.0.0, < 13.4.18 → fixed in 13.4.18 • Packagist typo3/cms-dashboard: >= 10.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-dashboard: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-dashboard: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-dashboard: >= 13.0.0, < 13.4.18 → fixed in 13.4.18 • Packagist typo3/cms-beuser: >= 13.0.0, < 13.4.18 → fixed in 13.4.18 • Packagist typo3/cms-beuser: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-beuser: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-beuser: >= 10.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-beuser: >= 9.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 9.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 10.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 13.0.0, < 13.4.18 → fixed in 13.4.18

Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Related

Alias · CVE (1)

  • CVE-2025-59017 Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References