Missing Authorization Checks in TYPO3 CMS Backend Routing
CVE-2025-59017

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 September 2025

What is CVE-2025-59017?

A lack of proper authorization checks in the Backend Routing of various TYPO3 CMS versions enables backend users to access AJAX routes directly, circumventing access controls associated with the relevant backend modules. This could potentially allow unauthorized users to execute operations they shouldn’t have access to, posing a significant security risk.

Affected Version(s)

TYPO3 CMS 9.0.0 < 9.5.55

TYPO3 CMS 10.0.0 < 10.4.54

TYPO3 CMS 11.0.0 < 11.5.48

References

https://typo3.org/security/advisory/typo3-core-sa-2025-021
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elias Häußler
Elias Häußler
JSON
.