N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59018

CVE-2025-59018: TYPO3 Workspaces Module Information Disclosure

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59018

CVE-2025-59018:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-workspaces	composer	>= 9.0.0, < 9.5.55	12.4.37
typo3/cms-workspaces	composer	>= 10.0.0, < 10.4.54	12.4.37
typo3/cms-workspaces	composer	>= 11.0.0, < 11.5.48	12.4.37
typo3/cms-workspaces	composer	>= 12.0.0, < 12.4.37	12.4.37
typo3/cms-workspaces	composer	>= 13.0.0, < 13.4.18	13.4.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an information disclosure issue in the TYPO3 Workspaces Module. The description explicitly mentions that missing authorization checks in an AJAX backend route allow backend users to disclose sensitive information. The provided commit 114c189c7b30181cee96d176e31f212b02d14d4d directly addresses this by adding authorization logic to the getRowDetails function within Classes/Service/GridDataService.php. The patch adds checks to ensure the user has the appropriate permissions (tables_modify) for the table they are trying to access, and that the table is workspace-aware. This confirms that getRowDetails was the vulnerable function, as it was processing requests without proper authorization, leading to the information disclosure. The new test file Tests/Functional/Service/GridDataServiceTest.php further confirms this by adding tests that assert that an exception is thrown when trying to access unauthorized tables, which is the behavior introduced by the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.