CVE-2025-59022 — Missing Authorization in CMS

CWE-862 — Missing Authorization5 documents5 sources
Severity
7.1HIGHNVD
EPSS
0.0%
top 95.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3 CMSTypo3Typo3 Cms-recycler
Timeline
PublishedJan 13

Description

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Packagisttypo3/cms-recycler14.0.0 — 14.0.2+4
▶NVDtypo3/typo310.0.0 — 10.4.55+4
▶CVEListV5typo3/typo3_cms10.0.0 — 10.4.55+4

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
TYPO3 CMS Allows Broken Access Control in Recycler Module↗2026-01-13
▶
CVEList
TYPO3 CMS Allows Broken Access Control in Recycler Module↗2026-01-13
▶
OSV
TYPO3 CMS Allows Broken Access Control in Recycler Module↗2026-01-13
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-59022 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-59022 — Missing Authorization in Typo3 CMS | cvebase