Vulnerability advisory

CVE-2025-59017

Broken Access Control in Backend AJAX Routes

Published Sep 9, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before fa6ceeff93eb36ad5e8b36abe4ca2b1644706304	`fa6ceeff93eb36ad5e8b36abe4ca2b1644706304`
fd8745e46bb11773e85524b8ee9650dabe340713 to before 34025c4b1658dffd995206bbf507124b6e357e89	`34025c4b1658dffd995206bbf507124b6e357e89`
Also listed as affected (64) `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‐9.5.54, 10.0.0‐10.4.53, 11.0.0‐11.5.47, 12.0.0‐12.4.36, and 13.0.0‐13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

CVE-2025-59017

Affected versions

Repository

Description

References