~ / search / GHSA-2fhw-2j7m-mr4m

GHSA-2fhw-2j7m-mr4m

TYPO3 backend modules have Broken Access Control

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-59017

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-workspaces >= 9.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-workspaces >= 10.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-workspaces >= 11.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-workspaces >= 12.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-workspaces >= 13.0.0, < 13.4.18 13.4.18
Packagist typo3/cms-recycler >= 9.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-recycler >= 10.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-recycler >= 11.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-recycler >= 12.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-recycler >= 13.0.0, < 13.4.18 13.4.18
Packagist typo3/cms-dashboard >= 10.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-dashboard >= 11.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-dashboard >= 12.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-dashboard >= 13.0.0, < 13.4.18 13.4.18
Packagist typo3/cms-beuser >= 13.0.0, < 13.4.18 13.4.18
Packagist typo3/cms-beuser >= 12.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-beuser >= 11.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-beuser >= 10.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-beuser >= 9.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-backend >= 9.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-backend >= 10.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-backend >= 11.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-backend >= 12.0.0, < 12.4.37 12.4.37
Packagist typo3/cms-backend >= 13.0.0, < 13.4.18 13.4.18

Details

As written in the advisory (Markdown source, shown as plain text).

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

References

External links from the advisory. They lead to third-party sites.