CVE-2025-7899

Insecure Direct Object Reference in extension "powermail" (powermail)

State: Published
Severity: 6.0 Medium
Published: Jul 22, 2025
Updated: Jul 22, 2025
Reserved: Jul 19, 2025

Description

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Extension "powermail"TYPO3	12.0.0 through 12.5.2Affected 13.0.0Affected

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-009

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.