Description

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

Remediation

References

CVE-2025-59018

Related Vulnerabilities

WordPress Plugin Cart66 Lite::WordPress Ecommerce SQL Injection (1.5.1.17)

TYPO3 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-55945)

Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.6)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor SQL Injection (3.3.2)

WordPress Plugin Facebook Like Box Unspecified Vulnerability (1.0.17)

Severity

Medium

Classification

CVE-2025-59018 CWE-200 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities