7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59022

CVE-2025-59022: TYPO3 CMS Allows Broken Access Control in Recycler Module

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59022

CVE-2025-59022:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-recycler	composer	>= 14.0.0, <= 14.0.1	14.0.2
typo3/cms-recycler	composer	>= 13.0.0, <= 13.4.22	13.4.23
typo3/cms-recycler	composer	>= 12.0.0, <= 12.4.40	12.4.41
typo3/cms-recycler	composer	>= 11.0.0, <= 11.5.48	11.5.49
typo3/cms-recycler	composer	>= 10.0.0, <= 10.4.54	10.4.55

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a broken access control issue in the TYPO3 CMS recycler module. The root cause is a failure to properly authorize record deletion requests. The exploitation flow starts in TYPO3\CMS\Recycler\Controller\RecyclerAjaxController::dispatch, where the deleteRecords action did not verify if the user had the necessary permissions to delete records. This allowed any authenticated backend user with access to the recycler module to proceed. The request is then passed to TYPO3\CMS\Recycler\Domain\Model\DeletedRecords::deleteData, which iterates over the records to be deleted. Crucially, this function called the low-level TYPO3\CMS\Core\DataHandling\DataHandler::deleteAction (or deleteEl) method with the $noRecordCheck parameter set to true. This flag intentionally disables all permission and ownership checks within the DataHandler, leading to the broken access control. As a result, an attacker could permanently delete arbitrary data from any database table, potentially causing a complete denial of service by destroying critical site data. The patches address this by adding permission checks in the RecyclerAjaxController and by changing the call in DeletedRecords to ensure the DataHandler's permission checks are not bypassed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.