CVE-2025-59017

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
TYPO3	TYPO3 CMS	>= 9.0.0, < 9.5.55; >= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18
TYPO3	TYPO3 CMS	>= 9.0.0, < 9.5.55; >= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18
TYPO3	TYPO3 CMS	>= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18
TYPO3	TYPO3 CMS	>= 9.0.0, < 9.5.55; >= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18
TYPO3	TYPO3 CMS	>= 9.0.0, < 9.5.55; >= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18

References

https://typo3.org/security/advisory/typo3-core-sa-2025-021Vendor Advisory

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590186.5Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and CVE-2025-590194.3Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow back CVE-2025-59028.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file CVE-2025-590206.5By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave CVE-2025-590216.4Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any r CVE-2025-590228.1Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of w CVE-2025-590238.2Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590246.5Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590256.1Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includi CVE-2025-590265.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-590287.5When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai CVE-2025-590295.3An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then