CVE-2025-59017 json
Broken Access Control in Backend AJAX Routes
published 2025-09-09 13 mo ago modified 2026-06-17 4 mo ago also GHSA-2fhw-2j7m-mr4m , EUVD-2025-27228
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
Patch / fix
- packagist typo3/cms-workspaces 12.4.37, 13.4.18
- packagist typo3/cms-recycler 12.4.37, 13.4.18
- packagist typo3/cms-dashboard 12.4.37, 13.4.18
- packagist typo3/cms-beuser 12.4.37, 13.4.18
- packagist typo3/cms-backend 12.4.37, 13.4.18
- TYPO3 TYPO3 CMS 9.5.55, 10.4.54, 11.5.48, 12.4.37, 13.4.18
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-workspaces | >=9.0.0, <12.4.37 >=10.0.0, <12.4.37 >=11.0.0, <12.4.37 >=12.0.0, <12.4.37 >=13.0.0, <13.4.18 |
12.4.37 13.4.18 |
| packagist | typo3/cms-recycler | >=9.0.0, <12.4.37 >=10.0.0, <12.4.37 >=11.0.0, <12.4.37 >=12.0.0, <12.4.37 >=13.0.0, <13.4.18 |
12.4.37 13.4.18 |
| packagist | typo3/cms-dashboard | >=10.0.0, <12.4.37 >=11.0.0, <12.4.37 >=12.0.0, <12.4.37 >=13.0.0, <13.4.18 |
12.4.37 13.4.18 |
| packagist | typo3/cms-beuser | >=13.0.0, <13.4.18 >=12.0.0, <12.4.37 >=11.0.0, <12.4.37 >=10.0.0, <12.4.37 >=9.0.0, <12.4.37 |
13.4.18 12.4.37 |
| packagist | typo3/cms-backend | >=9.0.0, <12.4.37 >=10.0.0, <12.4.37 >=11.0.0, <12.4.37 >=12.0.0, <12.4.37 >=13.0.0, <13.4.18 |
12.4.37 13.4.18 |
Affected products
- TYPO3 TYPO3 CMS
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/TYPO3-CMS/backend/commit/0aedf33d910bceafc2ed0e715743cc0d30124501
web
-
github.com
/TYPO3-CMS/beuser/commit/eb9b0c14a514a7aada8a2aa30e57696e286044c7
web
-
github.com
/TYPO3-CMS/dashboard/commit/582006c6bdf251160001eee6624901baccdcfcd2
web
-
github.com
/TYPO3-CMS/recycler/commit/43475578eb1d9fa3b765537c96bcdf48582ee53b
web
-
github.com
/TYPO3-CMS/workspaces/commit/32222508043940f9073c338d4205c730a2e02070
web
-
typo3.org
/security/advisory/typo3-core-sa-2025-021
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59017
advisory
Sources
- CVE List CVE-2025-59017
- GitHub Advisory GHSA-2fhw-2j7m-mr4m
- NVD CVE-2025-59017
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.