CVE-2025-59017CWE-862

Broken Access Control in Backend AJAX Routes

Medium · published September 9, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-09-09T09:01Z
EPSS history
Timeline
  • 09 SEP 09:01Z
    Broken Access Control in Backend AJAX Routes
    cvelistv5