CVE-2025-59018

Information Disclosure in Workspaces Module

State: Published
Severity: 7.1 High
Published: Sep 9, 2025
Updated: Sep 11, 2025
Reserved: Sep 7, 2025

Description

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
TYPO3 CMSTYPO3	9.0.0 to before 9.5.55Affected 10.0.0 to before 10.4.54Affected 11.0.0 to before 11.5.48Affected 12.0.0 to before 12.4.37Affected 13.0.0 to before 13.4.18Affected

References

https://typo3.org/security/advisory/typo3-core-sa-2025-022vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.