Vulnerability advisory

CVE-2025-59022

TYPO3 CMS Allows Broken Access Control in Recycler Module

Published Jan 13, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/benjaminkott/bootstrap_package ↗
a9914eb78915ee33a47e4317637b3b03a692fe58 to before ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96	`ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96`
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before 29ccb6fc4887fcb0f0ceac5bfd24d4993176c412	`29ccb6fc4887fcb0f0ceac5bfd24d4993176c412`
fd8745e46bb11773e85524b8ee9650dabe340713 to before ef75ec889ef10324e61df83ff994db67c4d45255	`ef75ec889ef10324e61df83ff994db67c4d45255`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before 62e93122ec75943aba5553b0aa1c6a50c4ccc27f	`62e93122ec75943aba5553b0aa1c6a50c4ccc27f`
Not specified	`336d6f165458a0ce32d8330999ab9ab6a5983d20`
Not specified	`a6604db66499710f72ae6e7006beb14ad0913aae`
Not specified	`efb9528f9882ac924c40598ebd8508479e9950a3`
Also listed as affected (77) `14.0.1` `14.0.0` `v13.4.22` `v12.4.40` `v13.4.21` `v14.0.1` `v14.0.0` `v13.4.20` `v12.4.39` `v13.4.19` `v12.4.38` `v13.4.18` `v12.4.37` `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-59022

Affected versions

Repository

Description

References