CVE-2025-59017: TYPO3 backend modules have Broken Access Control

The vulnerability is a Broken Access Control issue in TYPO3's backend. Authenticated backend users could call AJAX routes directly, even if they did not have the necessary permissions for the backend module associated with that route. The root cause was the TYPO3\CMS\Backend\Middleware\BackendModuleValidator::process middleware, which failed to perform authorization checks for these AJAX routes.

The security patches address this by introducing a new option, inheritAccessFromModule, for AJAX route configurations. This option links an AJAX route to a specific backend module. The BackendModuleValidator was updated to check this option and deny access if the user does not have permissions for the specified module, returning a 403 Forbidden status.

The analysis of the commits shows this pattern being applied across multiple components (typo3/cms-backend, typo3/cms-beuser, typo3/cms-dashboard, typo3/cms-recycler, typo3/cms-workspaces). The target property of the modified routes points directly to the controller methods that were vulnerable. These methods, which handle actions like renaming resources, managing dashboards, and handling localizations, would appear in a runtime profile or stack trace during exploitation. The identified functions are the direct entry points for the unauthorized actions.