CVE-2025-59017: TYPO3 CMS Backend Modules Vulnerability - Broken Access Control
Summary
CVE-2025-59017: TYPO3 backend modules have Broken Access Control. Affects typo3/cms-workspaces across 5 version ranges.
>= 9.0.0, < 12.4.37
>= 10.0.0, < 12.4.37
>= 11.0.0, < 12.4.37
>= 12.0.0, < 12.4.37
>= 13.0.0, < 13.4.18
Fixed in 12.4.37 or 13.4.18, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage digital content efficiently. It is widely used for building websites and applications due to its flexibility, scalability, and extensive feature set. However, certain versions of TYPO3 CMS have been found to contain a vulnerability that allows unauthorized access to backend modules, potentially compromising the security of the system.
Vulnerability Detail
The vulnerability arises from missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0 to 9.5.54, 10.0.0 to 10.4.53, 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17. This oversight allows backend users to directly invoke AJAX backend routes without the necessary permissions, leading to unauthorized access to sensitive backend functionalities. The implications of this vulnerability can be severe, as it may allow attackers to manipulate backend data or perform actions that should be restricted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 12.4.3712.4.37composer require typo3/cms-workspaces:12.4.37 -
>= 10.0.0, < 12.4.3712.4.37composer require typo3/cms-workspaces:12.4.37 -
>= 11.0.0, < 12.4.3712.4.37composer require typo3/cms-workspaces:12.4.37 -
>= 12.0.0, < 12.4.3712.4.37composer require typo3/cms-workspaces:12.4.37 -
>= 13.0.0, < 13.4.1813.4.18composer require typo3/cms-workspaces:13.4.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the backend modules by adjusting user permissions and roles within the TYPO3 backend settings. This will help mitigate the risk of unauthorized access until the package is updated.
Conclusion
In summary, CVE-2025-59017 is a significant vulnerability in TYPO3 CMS that allows unauthorized access to backend modules due to missing authorization checks. It is crucial to update to the latest patched versions to ensure the security of your TYPO3 installation.
See every vulnerability recorded for typo3/cms-workspaces →
FAQ
CVE-2025-59017 is a vulnerability identifier for a broken access control issue in TYPO3 CMS that allows unauthorized access to backend modules.
The affected versions are 9.0.0 to 9.5.54, 10.0.0 to 10.4.53, 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider adjusting user permissions in the TYPO3 backend to restrict access to sensitive modules as a temporary workaround.
The vulnerability could allow unauthorized users to access and manipulate backend data, leading to data breaches or unauthorized actions within the TYPO3 CMS.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-workspaces.
