CVE-2025-47937

TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

State: Published
Severity: 3.7 Low
Published: May 20, 2025
Updated: May 20, 2025
Reserved: May 14, 2025

Description

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
typo3TYPO3	>= 9.0.0, < 9.5.51Affected >= 10.0.0, < 10.4.50Affected >= 11.0.0, < 11.5.44Affected >= 12.0.0, < 12.4.31Affected >= 13.0.0, < 13.4.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.