What is CVE-2025-59017?

CVE-2025-59017 is a vulnerability in Typo3 Cms, classified under Missing Authorization. Published 2025-09-09.

Is CVE-2025-59017 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Typo3 Cms

CVE-2025-59017

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to…

Vulnerability class: Broken Access Control

EPSS: 0.001 (26.8th percentile) — read the EPSS interpretation.

Affected products

Typo3 Cms — versions 9.0.0, 10.0.0, 11.0.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

typo3.org/security/advisory/typo3-core-sa-2025-021 (vendor-advisory)

Frequently asked questions

What is CVE-2025-59017?: CVE-2025-59017 is a vulnerability in Typo3 Cms, classified under Missing Authorization. Published 2025-09-09.
Is CVE-2025-59017 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.