CVE-2025-59017 — Broken Access Control in Backend AJAX Routes

Description (CNA)

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Affected (CNA)

Vendor / product	Versions
TYPO3 / TYPO3 CMS	affected 9.0.0 before 9.5.55; affected 10.0.0 before 10.4.54; affected 11.0.0 before 11.5.48; affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18
TYPO3 / TYPO3 CMS	affected 9.0.0 before 9.5.55; affected 10.0.0 before 10.4.54; affected 11.0.0 before 11.5.48; affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18
TYPO3 / TYPO3 CMS	affected 10.0.0 before 10.4.54; affected 11.0.0 before 11.5.48; affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18
TYPO3 / TYPO3 CMS	affected 9.0.0 before 9.5.55; affected 10.0.0 before 10.4.54; affected 11.0.0 before 11.5.48; affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18
TYPO3 / TYPO3 CMS	affected 9.0.0 before 9.5.55; affected 10.0.0 before 10.4.54; affected 11.0.0 before 11.5.48; affected 12.0.0 before 12.4.37; affected 13.0.0 before 13.4.18

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-core-sa-2025-021

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.