CVE-2025-59018

MEDIUM

TYPO3 CMS 9.0.0-13.4.17 - Unauthorized Sensitive Information Exposure via Workspace Module

Title source: llm
STIX 2.1

Description

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0006
EPSS Percentile 17.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
typo3/cms-workspaces 9.0.0 - 12.4.37Packagist
typo3/typo3 9.0.0 - 9.5.55
Published Sep 09, 2025
Tracked Since Feb 18, 2026