Broken Access Control in Backend AJAX Routes_CVE-2025-59017

{
    "lastseen": "",
    "description": "Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0\u20119.5.54, 10.0.0\u201110.4.53, 11.0.0\u201111.5.47, 12.0.0\u201112.4.36, and 13.0.0\u201113.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.",
    "published": "2025-09-09T09:01:03.951Z",
    "modified": "2025-09-09T09:01:03.951Z",
    "type": "cve",
    "title": "Broken Access Control in Backend AJAX Routes",
    "source": "TYPO3",
    "references": "https://typo3.org/security/advisory/typo3-core-sa-2025-021",
    "id": "CVE-2025-59017",
    "bulletinFamily": "",
    "cwe": [
        "CWE-862"
    ],
    "cvelist": null,
    "sourceData": "TYPO3 TYPO3 CMS 9.0.0\nTYPO3 TYPO3 CMS 10.0.0\nTYPO3 TYPO3 CMS 11.0.0\nTYPO3 TYPO3 CMS 12.0.0\nTYPO3 TYPO3 CMS 13.0.0\nTYPO3 TYPO3 CMS 9.0.0\nTYPO3 TYPO3 CMS 10.0.0\nTYPO3 TYPO3 CMS 11.0.0\nTYPO3 TYPO3 CMS 12.0.0\nTYPO3 TYPO3 CMS 13.0.0\nTYPO3 TYPO3 CMS 10.0.0\nTYPO3 TYPO3 CMS 11.0.0\nTYPO3 TYPO3 CMS 12.0.0\nTYPO3 TYPO3 CMS 13.0.0\nTYPO3 TYPO3 CMS 9.0.0\nTYPO3 TYPO3 CMS 10.0.0\nTYPO3 TYPO3 CMS 11.0.0\nTYPO3 TYPO3 CMS 12.0.0\nTYPO3 TYPO3 CMS 13.0.0\nTYPO3 TYPO3 CMS 9.0.0\nTYPO3 TYPO3 CMS 10.0.0\nTYPO3 TYPO3 CMS 11.0.0\nTYPO3 TYPO3 CMS 12.0.0\nTYPO3 TYPO3 CMS 13.0.0",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "TYPO3 CMS",
    "version": "9.0.0",
    "vendor": "TYPO3",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}