Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-59017

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

VectorNETWORK

PublishedSep 09, 2025, 09:15

Published Byf4fb688c-4412-4426-b4b8-421ecf27b14a

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

typo3/cms-workspaces(Packagist)9.0.012.4.37N/A

typo3/cms-workspaces(Packagist)10.0.012.4.37N/A

typo3/cms-workspaces(Packagist)11.0.012.4.37N/A

typo3/cms-workspaces(Packagist)12.0.012.4.37N/A

typo3/cms-workspaces(Packagist)13.0.013.4.18N/A

typo3/cms-recycler(Packagist)9.0.012.4.37N/A

typo3/cms-recycler(Packagist)10.0.012.4.37N/A

typo3/cms-recycler(Packagist)11.0.012.4.37N/A

typo3/cms-recycler(Packagist)12.0.012.4.37N/A

typo3/cms-recycler(Packagist)13.0.013.4.18N/A

typo3/cms-dashboard(Packagist)10.0.012.4.37N/A

typo3/cms-dashboard(Packagist)11.0.012.4.37N/A

typo3/cms-dashboard(Packagist)12.0.012.4.37N/A

typo3/cms-dashboard(Packagist)13.0.013.4.18N/A

typo3/cms-beuser(Packagist)13.0.013.4.18N/A

typo3/cms-beuser(Packagist)12.0.012.4.37N/A

typo3/cms-beuser(Packagist)11.0.012.4.37N/A

typo3/cms-beuser(Packagist)10.0.012.4.37N/A

typo3/cms-beuser(Packagist)9.0.012.4.37N/A

typo3/cms-backend(Packagist)9.0.012.4.37N/A

typo3/cms-backend(Packagist)10.0.012.4.37N/A

typo3/cms-backend(Packagist)11.0.012.4.37N/A

typo3/cms-backend(Packagist)12.0.012.4.37N/A

typo3/cms-backend(Packagist)13.0.013.4.18N/A

References

https://typo3.org/security/advisory/typo3-core-sa-2025-021

Weakness Type

CWE-862

CVSS Metrics

Base Score

5.3

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK

CVE-2025-59017

VectorNETWORK

PublishedSep 09, 2025, 09:15

Published Byf4fb688c-4412-4426-b4b8-421ecf27b14a