CVE-2025-59022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59022", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "state": "PUBLISHED", "assignerShortName": "TYPO3", "dateReserved": "2025-09-07T19:01:20.436Z", "datePublished": "2026-01-13T11:53:45.184Z", "dateUpdated": "2026-01-13T14:21:59.794Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "modules": ["Recycler"], "packageName": "typo3/cms-recycler", "product": "TYPO3 CMS", "repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "versions": [{"lessThan": "10.4.55", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.5.49", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.4.41", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "13.4.23", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "14.0.2", "status": "affected", "version": "14.0.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.4.55", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "11.5.49", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "12.4.41", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "13.4.23", "versionStartIncluding": "13.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "versionEndExcluding": "14.0.2", "versionStartIncluding": "14.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Sven J\u00fcrgens"}, {"lang": "en", "type": "reporter", "value": "Daniel Windloff"}, {"lang": "en", "type": "remediation developer", "value": "Elias H\u00e4u\u00dfler"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the <code>TCA</code> - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1."}], "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-01-13T11:53:45.184Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-003"}, {"name": "Git commit of main branch", "tags": ["patch"], "url": "https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20"}, {"name": "Git commit of 13.4 branch", "tags": ["patch"], "url": "https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3"}, {"name": "Git commit of 12.4 branch", "tags": ["patch"], "url": "https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae"}], "source": {"discovery": "UNKNOWN"}, "title": "TYPO3 CMS Allows Broken Access Control in Recycler Module", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:19:35.396050Z", "id": "CVE-2025-59022", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:21:59.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:19:35.396050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:21:56.579Z"}}], "cna": {"title": "TYPO3 CMS Allows Broken Access Control in Recycler Module", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Sven J\u00fcrgens"}, {"lang": "en", "type": "reporter", "value": "Daniel Windloff"}, {"lang": "en", "type": "remediation developer", "value": "Elias H\u00e4u\u00dfler"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "modules": ["Recycler"], "product": "TYPO3 CMS", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.4.55", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.5.49", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.4.41", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.4.23", "versionType": "semver"}, {"status": "affected", "version": "14.0.0", "lessThan": "14.0.2", "versionType": "semver"}], "packageName": "typo3/cms-recycler", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://typo3.org/security/advisory/typo3-core-sa-2026-003", "tags": ["vendor-advisory"]}, {"url": "https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20", "name": "Git commit of main branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3", "name": "Git commit of 13.4 branch", "tags": ["patch"]}, {"url": "https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae", "name": "Git commit of 12.4 branch", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.", "supportingMedia": [{"type": "text/html", "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the <code>TCA</code> - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.4.55", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.5.49", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.4.41", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "13.4.23", "versionStartIncluding": "13.0.0"}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "14.0.2", "versionStartIncluding": "14.0.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "shortName": "TYPO3", "dateUpdated": "2026-01-13T11:53:45.184Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59022", "state": "PUBLISHED", "dateUpdated": "2026-01-13T14:21:59.794Z", "dateReserved": "2025-09-07T19:01:20.436Z", "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "datePublished": "2026-01-13T11:53:45.184Z", "assignerShortName": "TYPO3"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "modules": ["Recycler"], "packageName": "typo3/cms-recycler", "product": "TYPO3 CMS", "repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "versions": [{"lessThan": "10.4.55", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.5.49", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.4.41", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThan": "13.4.23", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "14.0.2", "status": "affected", "version": "14.0.0", "versionType": "semver"}]}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F66D2E5-38C1-4708-BBEA-6963B2AFEA8B", "versionEndExcluding": "10.4.55", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E718BBF-B384-4223-A53D-528F77E17DC2", "versionEndExcluding": "11.5.49", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "D330992D-8C99-458A-A139-47407B4BBB66", "versionEndExcluding": "12.4.41", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA2179C6-E438-4413-A717-9112618BA6CF", "versionEndExcluding": "13.4.23", "versionStartIncluding": "13.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*", "matchCriteriaId": "310C5FCB-6F96-4409-BB9A-E582E18E067A", "versionEndExcluding": "14.0.2", "versionStartIncluding": "14.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1."}, {"lang": "es", "value": "Los usuarios de backend que ten\u00edan acceso al m\u00f3dulo de reciclador pod\u00edan eliminar datos arbitrarios de cualquier tabla de base de datos definida en el TCA - independientemente de si ten\u00edan permiso para esa tabla en particular. Esto permit\u00eda a los atacantes purgar y destruir datos cr\u00edticos del sitio, dejando el sitio web efectivamente no disponible. Este problema afecta a las versiones de TYPO3 CMS 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 y 14.0.0-14.0.1."}], "id": "CVE-2025-59022", "lastModified": "2026-06-17T09:45:27.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59022", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:19:35.396050Z", "version": "2.0.3"}}]}, "published": "2026-01-13T12:15:50.237", "references": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"], "url": "https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"], "url": "https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Patch"], "url": "https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3"}, {"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-003"}], "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "type": "Secondary"}]}

{}

{}