Vulnerability advisory

CVE-2025-59018

Information Disclosure in Workspaces Module

Published Sep 9, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before fa6ceeff93eb36ad5e8b36abe4ca2b1644706304	`fa6ceeff93eb36ad5e8b36abe4ca2b1644706304`
fd8745e46bb11773e85524b8ee9650dabe340713 to before 34025c4b1658dffd995206bbf507124b6e357e89	`34025c4b1658dffd995206bbf507124b6e357e89`
Also listed as affected (64) `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‐9.5.54, 10.0.0‐10.4.53, 11.0.0‐11.5.47, 12.0.0‐12.4.36, and 13.0.0‐13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

CVE-2025-59018

Affected versions

Repository

Description

References