CVE-2025-47937: TYPO3 cms-core Information Disclosure via DBAL Restriction Handling
Summary
CVE-2025-47937: TYPO3 Allows Information Disclosure via DBAL Restriction Handling. Affects typo3/cms-core across 5 version ranges.
>= 9.0.0, < 9.5.51
>= 10.0.0, < 10.4.50
>= 11.0.0, < 11.5.44
>= 12.0.0, < 12.4.31
>= 13.0.0, < 13.4.12
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It provides a robust framework for developers and offers extensive features for content creation, user management, and site administration. However, like any software, TYPO3 is susceptible to vulnerabilities that can compromise its security and the data it handles.
Vulnerability Detail
The vulnerability arises from a flaw in TYPO3's database abstraction layer (DBAL) where frontend user permissions are only enforced on the last table of a multi-table query. This oversight can lead to unauthorized data exposure from other tables included in the same query, potentially allowing users to access sensitive information they should not have permission to view. The issue is classified under CWE-863, which pertains to improper authorization.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.519.5.51composer require typo3/cms-core:9.5.51 -
>= 10.0.0, < 10.4.5010.4.50composer require typo3/cms-core:10.4.50 -
>= 11.0.0, < 11.5.4411.5.44composer require typo3/cms-core:11.5.44 -
>= 12.0.0, < 12.4.3112.4.31composer require typo3/cms-core:12.4.31 -
>= 13.0.0, < 13.4.1213.4.12composer require typo3/cms-core:13.4.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the use of multi-table queries until the TYPO3 update is applied. Additionally, review user permissions to ensure sensitive data is adequately protected.
Conclusion
The CVE-2025-47937 vulnerability in TYPO3's DBAL poses a risk of unauthorized data exposure due to improper permission handling. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your TYPO3 installation.
See every vulnerability recorded for typo3/cms-core →
FAQ
CVE-2025-47937 is a vulnerability in TYPO3's database abstraction layer that allows unauthorized information disclosure due to improper handling of user permissions.
If your TYPO3 installation is affected, unauthorized users may gain access to sensitive data from multiple tables in database queries, posing a significant security risk.
Affected versions include TYPO3 9.0.0 to 9.5.50, 10.0.0 to 10.4.49, 11.0.0 to 11.5.43, 12.0.0 to 12.4.30, and 13.0.0 to 13.4.11.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
