Medium
Broken Access Control in Backend AJAX Routes
Type: advisorySources: OSV
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-59017
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:31 UTC · Revision 1
Source evidence
Broken Access Control in Backend AJAX Routes
core-osv · Original sourcePublished 9 Sept 2025, 09:01 UTC
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
osv:CVE-2025-59017
Complete source record
{
"id": "30b4bda681aa89e6877b5363b1edba046ff522ab15e07d33ebf9d63a983d34a2",
"url": "https://osv.dev/vulnerability/CVE-2025-59017",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Broken Access Control in Backend AJAX Routes",
"summary": "Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.",
"evidence": "osv:CVE-2025-59017",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-59017",
"aliases": [
"CVE-2025-59017",
"GHSA-2fhw-2j7m-mr4m"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/typo3/typo3",
"type": "GIT",
"events": [
{
"introduced": "36096733dea4bd6f6168209609fa879dc25c0138"
},
{
"fixed": "fa6ceeff93eb36ad5e8b36abe4ca2b1644706304"
},
{
"introduced": "fd8745e46bb11773e85524b8ee9650dabe340713"
},
{
"fixed": "34025c4b1658dffd995206bbf507124b6e357e89"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.37"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.4.18"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v12.4.36",
"v13.4.17",
"v13.4.16",
"v12.4.35",
"v13.4.15",
"v12.4.34",
"v13.4.14",
"v12.4.33",
"v13.4.13",
"v12.4.32",
"v13.4.12",
"v12.4.31",
"v13.4.11",
"v12.4.30",
"v13.4.10",
"v12.4.29",
"v13.4.9",
"v13.4.8",
"v12.4.28",
"v13.4.7",
"v13.4.6",
"v13.4.5",
"v12.4.27",
"v13.4.4",
"v12.4.26",
"v13.4.3",
"v12.4.25",
"v13.4.2",
"v12.4.24",
"v13.4.1",
"v12.4.23",
"v12.4.22",
"v13.4.0",
"v12.4.21",
"v13.3.0",
"v12.4.20",
"v12.4.19",
"v12.4.18",
"v12.4.17",
"v13.2.1",
"v13.2.0",
"v12.4.16",
"v12.4.15",
"v13.1.0",
"v12.4.14",
"v12.4.13",
"v12.4.12",
"v12.4.11",
"v13.0.0",
"v12.4.10",
"v12.4.9",
"v12.4.8",
"v12.4.7",
"v12.4.6",
"v12.4.5",
"v12.4.4",
"v12.4.3",
"v12.4.2",
"v12.4.1",
"v12.4.0",
"v12.3.0",
"v12.2.0",
"v12.1.0",
"v12.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59017.json"
}
}
],
"modified": "2026-10-28T02:30:37.784100902Z",
"provider": "osv",
"references": [
"https://packagist.org",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59017.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-59017",
"https://typo3.org/security/advisory/typo3-core-sa-2025-021",
"https://github.com/TYPO3/typo3"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "TYPO3",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.55"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.54"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.48"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.55"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.54"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.48"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.54"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.48"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.55"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.54"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.48"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.55"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.54"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.48"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59017.json"
}
},
"related_cves": [
{
"value": "CVE-2025-59017",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505341,
"published_at": "2025-09-09T09:01:03.951+00:00"
}