GHSA-w2pf-7q5w-2cgw
TYPO3 Workspaces Module Information Disclosure
At a glance
- Published
- Updated
- CVE
- CVE-2025-59018
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
Affected packages
| Package | Versions |
|---|---|
| Packagist · typo3/cms-workspaces | introduced 9.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 10.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 11.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 12.0.0, fixed 12.4.37 |
| Packagist · typo3/cms-workspaces | introduced 13.0.0, fixed 13.4.18 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-59018 ADVISORY
- https://github.com/TYPO3-CMS/workspaces/commit/114c189c7b30181cee96d176e31f212b02d14d4d WEB
- https://github.com/TYPO3-CMS/workspaces PACKAGE
- https://typo3.org/security/advisory/typo3-core-sa-2025-022 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |