-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in the page tree rendering mechanism. The PageTreeRepository::getTreeData method is responsible for fetching and constructing the page tree structure displayed in the backend. In affected versions, this function likely failed to properly integrate backend user permissions checks when retrieving page nodes, resulting in pages being visible to users without read access. The fix in v9.5.6 would have added proper permission checks (likely using TYPO3's PagePermission system) during tree data retrieval. The confidence is high because this component is directly responsible for page tree presentation and matches the described vulnerability pattern of missing authorization checks in tree rendering.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 9.0.0, < 9.5.6 | 9.5.6 |
Ongoing coverage of React2Shell