5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59021

CVE-2025-59021: TYPO3 CMS Allows Broken Access Control in Redirects Module

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59021

CVE-2025-59021:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-redirects	composer	>= 14.0.0, <= 14.0.1	14.0.2
typo3/cms-redirects	composer	>= 13.0.0, <= 13.4.22	13.4.23
typo3/cms-redirects	composer	>= 12.0.0, <= 12.4.40	12.4.41
typo3/cms-redirects	composer	>= 11.0.0, <= 11.5.48	11.5.49
typo3/cms-redirects	composer	>= 10.0.0, <= 10.4.54	10.4.55

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a broken access control issue in the TYPO3 CMS redirects module. The analysis of the provided patches reveals that several functions in the module lacked proper permission checks, allowing backend users with basic access to the module to read, create, and modify any redirect record without restriction. The core of the issue lies in the failure to check the user's web-mounts and file-mounts.

The vulnerable functions were identified by observing where the security patches added new permission checks. The main points of entry for the vulnerability were:

ManagementController::handleRequest: This function, which renders the redirects management interface, did not check for list or edit permissions, giving any user who could access the module full visibility and control over all redirects.
RedirectRepository::findRedirectsByDemand and countRedirectsByByDemand: These functions were responsible for querying the database for redirects. They did not filter the results based on the user's permissions, leading to the disclosure of all redirect records.
ValuePickerItemDataProvider::addData: This function populated the redirect form with a list of all available source hosts, exposing the existence of sites the user was not supposed to have access to.

The patch introduces a new RedirectPermissionGuard class to centralize access control logic and a DataHandlerPermissionGuardHook to intercept and validate all create/update operations on redirect records. The vulnerable functions were modified to use these new security mechanisms, thus closing the access control gap.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.