Riskcovery

CVE-2025-59017

Broken Access Control in Backend AJAX Routes

State
Published
Severity
5.3 Medium
Published
Sep 9, 2025
Updated
Sep 9, 2025
Reserved
Sep 7, 2025

Read the record on cve.org

Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NTYPO3

Weaknesses

Affected Products

ProductVersions
TYPO3 CMSTYPO3
  • 9.0.0 to before 9.5.55Affected
  • 10.0.0 to before 10.4.54Affected
  • 11.0.0 to before 11.5.48Affected
  • 12.0.0 to before 12.4.37Affected
  • 13.0.0 to before 13.4.18Affected
TYPO3 CMSTYPO3
  • 9.0.0 to before 9.5.55Affected
  • 10.0.0 to before 10.4.54Affected
  • 11.0.0 to before 11.5.48Affected
  • 12.0.0 to before 12.4.37Affected
  • 13.0.0 to before 13.4.18Affected
TYPO3 CMSTYPO3
  • 10.0.0 to before 10.4.54Affected
  • 11.0.0 to before 11.5.48Affected
  • 12.0.0 to before 12.4.37Affected
  • 13.0.0 to before 13.4.18Affected
TYPO3 CMSTYPO3
  • 9.0.0 to before 9.5.55Affected
  • 10.0.0 to before 10.4.54Affected
  • 11.0.0 to before 11.5.48Affected
  • 12.0.0 to before 12.4.37Affected
  • 13.0.0 to before 13.4.18Affected
TYPO3 CMSTYPO3
  • 9.0.0 to before 9.5.55Affected
  • 10.0.0 to before 10.4.54Affected
  • 11.0.0 to before 11.5.48Affected
  • 12.0.0 to before 12.4.37Affected
  • 13.0.0 to before 13.4.18Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.