Packagist/typo3/cms-backend CVE-2025-59017: high 8.8, EPSS 0.30%

TYPO3 backend modules have Broken Access Control

Action: Upgrade typo3/cms-backend to 12.4.37 or later.

composer require typo3/cms-backend:12.4.37

composer require typo3/cms-backend:13.4.18

Affected

Fixed versions

Sources

• osv: GHSA-2fhw-2j7m-mr4m#Packagist/typo3/cms-backend
• nvd: CVE-2025-59017
• https://github.com/TYPO3-CMS/backend/commit/0aedf33d910bceafc2ed0e715743cc0d30124501
• https://github.com/TYPO3-CMS/beuser/commit/eb9b0c14a514a7aada8a2aa30e57696e286044c7
• https://github.com/TYPO3-CMS/dashboard/commit/582006c6bdf251160001eee6624901baccdcfcd2
• https://github.com/TYPO3-CMS/recycler/commit/43475578eb1d9fa3b765537c96bcdf48582ee53b
• https://github.com/TYPO3-CMS/workspaces/commit/32222508043940f9073c338d4205c730a2e02070
• https://typo3.org/security/advisory/typo3-core-sa-2025-021

CVE-2025-59017 · published 2025-09-09T09:31:13Z · modified 2025-09-09T20:44:49.353963Z · JSON