High severity · published Sep 9, 2025
CVE-2025-59017
Broken Access Control in Backend AJAX Routes
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TYPO3 CMS · TYPO3
9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18; 9.0.0 before 9.5.55; +18 more · source: vendor
TY
Typo3 · Typo3
9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59017
Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2025-021
More from TYPO3 CMS
8.7
CVE-2026-49741
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
8.1
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
7.8
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
7.6
CVE-2026-47346
TYPO3 CMS - Broken Access Control in Form Framework
7.6
CVE-2026-11607
TYPO3 CMS - Broken Access Control in Form Framework