DemoBook a demo

Vulnerability advisory

GHSA-2fhw-2j7m-mr4m

TYPO3 backend modules have Broken Access Control

Published Updated OSV record ↗

Also known as CVE-2025-59017

Severity
  • CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected versions

typo3/cms-workspaces Packagist

All typo3/cms-workspaces advisories →
AffectedFixed in
9.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (179)
10.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (138)
11.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (95)
12.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (44)
13.0.0 to before 13.4.1813.4.18Advisories →
Also listed as affected (25)

typo3/cms-recycler Packagist

All typo3/cms-recycler advisories →
AffectedFixed in
9.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (179)
10.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (138)
11.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (95)
12.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (44)
13.0.0 to before 13.4.1813.4.18Advisories →
Also listed as affected (25)

typo3/cms-dashboard Packagist

All typo3/cms-dashboard advisories →
AffectedFixed in
10.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (133)
11.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (95)
12.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (44)
13.0.0 to before 13.4.1813.4.18Advisories →
Also listed as affected (25)

typo3/cms-beuser Packagist

All typo3/cms-beuser advisories →
AffectedFixed in
13.0.0 to before 13.4.1813.4.18Advisories →
Also listed as affected (25)
12.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (44)
11.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (95)
10.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (138)
9.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (179)

typo3/cms-backend Packagist

All typo3/cms-backend advisories →
AffectedFixed in
9.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (179)
10.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (138)
11.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (95)
12.0.0 to before 12.4.3712.4.37Advisories →
Also listed as affected (44)
13.0.0 to before 13.4.1813.4.18Advisories →
Also listed as affected (25)

Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‐9.5.54, 10.0.0‐10.4.53, 11.0.0‐11.5.47, 12.0.0‐12.4.36, and 13.0.0‐13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.