CVE-2025-59018

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59018
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59018.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59018
Aliases
Published
2025-09-09T09:01:10.275Z
Modified
2026-07-08T06:00:24.214471988Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Information Disclosure in Workspaces Module
Details

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.5.55"
                },
                {
                    "introduced": "10.0.0"
                },
                {
                    "fixed": "10.4.54"
                },
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.5.48"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59018.json",
    "cna_assigner": "TYPO3",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
36096733dea4bd6f6168209609fa879dc25c0138
Fixed
fa6ceeff93eb36ad5e8b36abe4ca2b1644706304
Introduced
fd8745e46bb11773e85524b8ee9650dabe340713
Fixed
34025c4b1658dffd995206bbf507124b6e357e89
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.4.37"
        },
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.4.18"
        }
    ]
}

Affected versions

v12.*
v12.0.0
v12.1.0
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.*
v13.0.0
v13.1.0
v13.2.0
v13.2.1
v13.3.0
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59018.json"