CVE-2025-59017 MEDIUM

CVE-2025-59017: Broken Access Control in Backend AJAX Routes

Vendor Typo3
Product TYPO3 CMS
Weakness CWE-862 · Missing authorization
Published September 9, 2025
Last update September 9, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Key dates

02Disclosure timeline

September 9, 2025 CVE published
September 9, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13364 Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset CVE-2024-3599 WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion CVE-2023-32506 WordPress Link Whisper Free plugin <= 0.6.3 - Unauthenticated Broken Access Control vulnerability CVE-2024-8678 Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update CVE-2024-38744 WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability