CVE-2025-59017: 
PHP vulnerability analysis and mitigation

CVE-2025-59017 is a Missing Authorization (CWE-862) vulnerability in TYPO3 CMS Backend Routing, classified as "Broken Access Control" in backend modules. It affects TYPO3 CMS versions 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17, spanning the Composer packages typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard, typo3/cms-recycler, and typo3/cms-workspaces. The vulnerability was published on September 9, 2025. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, TYPO3 Advisory).

The root cause is missing authorization checks (CWE-862) in TYPO3's Backend Routing layer, which handles AJAX requests to backend routes. Authenticated backend users — even those without access to specific backend modules — can directly invoke AJAX backend routes that should be restricted to users with the corresponding module permissions. The attack vector is network-based, requires low privileges (any valid backend account), no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has any backend credentials (GitHub Advisory, TYPO3 Advisory). Patches were applied across multiple TYPO3 core packages including commits to TYPO3-CMS/backend, TYPO3-CMS/beuser, TYPO3-CMS/dashboard, TYPO3-CMS/recycler, and TYPO3-CMS/workspaces (GitHub Advisory).

Successful exploitation allows authenticated backend users with limited privileges to bypass module-level access controls and invoke restricted AJAX backend routes, potentially accessing or modifying data they are not authorized to interact with. This can result in unauthorized disclosure of sensitive CMS content, unauthorized modifications to site data or configuration, and potential disruption of backend functionality. The confidentiality, integrity, and availability of the vulnerable TYPO3 system are all impacted, though subsequent (downstream) system impact is assessed as none under CVSS v4.0 (GitHub Advisory, TYPO3 Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.038% (27th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 261778 (Tenable).

1. Obtain backend credentials: Acquire any valid TYPO3 backend user account, even one with minimal permissions (e.g., a restricted editor account).
2. Identify target AJAX routes: Review TYPO3 backend routing configuration or documentation to enumerate AJAX routes associated with privileged modules (e.g., Recycler, Workspaces, Dashboard, BE User management) that the attacker's account does not have module access to.
3. Craft a direct AJAX request: Using a browser, proxy tool (e.g., Burp Suite), or scripted HTTP client, construct an authenticated HTTP request targeting the restricted AJAX backend route endpoint directly, bypassing the normal module access check.
4. Submit the request: Send the crafted request with the authenticated session cookie/token. Due to missing authorization checks in the Backend Routing layer, the server processes the request without verifying module-level access.
5. Achieve unauthorized action: Depending on the targeted route, the attacker may read restricted data, modify records, or trigger backend operations beyond their assigned permissions (GitHub Advisory, TYPO3 Advisory).

• Network: Authenticated HTTP requests from backend user sessions to AJAX routes associated with modules (e.g., Recycler, Workspaces, Dashboard, BE User) that the user's role does not have access to; unusual patterns of AJAX calls from low-privilege accounts.
• Logs: TYPO3 backend access logs showing requests to restricted AJAX route endpoints from user accounts not assigned to the corresponding backend modules; repeated or scripted access patterns to multiple AJAX endpoints from a single session.
• Application: Backend audit logs (if enabled) recording actions in modules (e.g., record restoration via Recycler, workspace operations) performed by users who lack the corresponding module assignment.

TYPO3 has released patched versions addressing this vulnerability: 9.5.55, 10.4.54, 11.5.48, 12.4.37, and 13.4.18. Administrators should update all affected Composer packages (typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard, typo3/cms-recycler, typo3/cms-workspaces) to their respective patched versions immediately. As interim measures, administrators should audit and restrict backend user access permissions, enforce strict role-based access controls, and monitor backend route access logs for anomalous activity (TYPO3 Advisory, GitHub Advisory).