CVE-2025-59018

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17

Description: The Workspace Module in TYPO3 CMS is susceptible to missing authorization checks. This allows backend users to directly invoke the corresponding AJAX backend route, potentially disclosing sensitive information without proper access.

Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 10.0.0 through 10.4.53: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 11.0.0 through 11.5.47: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 12.0.0 through 12.4.36: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 13.0.0 through 13.4.17: Implement robust authorization checks for the Workspace Module's AJAX backend routes.