CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
TYPO3 CMS Allows Broken Access Control in Recycler Module
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- Record
CVE-2025-59022- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-2088
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- Record
EUVD-2026-2088- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p52w-7rhw-9m67
TYPO3 CMS Allows Broken Access Control in Recycler Module
Problem
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable.
Solution
Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.
Credits
Thanks to Sven Jürgens and Daniel Windloff for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.
References
- Record
GHSA-p52w-7rhw-9m67- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- Record
CVE-2025-59022- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
TYPO3 CMS Allows Broken Access Control in Recycler Module
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- Record
CVE-2025-59022- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-p52w-7rhw-9m67
TYPO3 CMS Allows Broken Access Control in Recycler Module
Problem
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable.
Solution
Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.
Credits
Thanks to Sven Jürgens and Daniel Windloff for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.
References
- Record
GHSA-p52w-7rhw-9m67- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-recyclerPackagist |
14.0.0 to 14.0.1 | 14.0.2 |
typo3/cms-recyclerPackagist |
13.0.0 to 13.4.22 | 13.4.23 |
typo3/cms-recyclerPackagist |
12.0.0 to 12.4.40 | 12.4.41 |
typo3/cms-recyclerPackagist |
11.0.0 to 11.5.48 | 11.5.49 |
typo3/cms-recyclerPackagist |
10.0.0 to 10.4.54 | 10.4.55 |
typo3/cms-recyclerPackagist |
14.0.0 up to 14.0.2, plus listed versions v14.0.0v14.0.1 |
14.0.2 |
typo3/cms-recyclerPackagist |
13.0.0 up to 13.4.23, plus listed versions v13.0.0v13.0.1v13.1.0v13.1.1v13.2.1 Show 25 moreShow lessv13.3.0v13.3.1v13.4.0v13.4.1v13.4.10v13.4.11v13.4.12v13.4.13v13.4.14v13.4.15v13.4.16v13.4.17v13.4.18v13.4.19v13.4.2v13.4.20v13.4.21v13.4.22v13.4.3v13.4.4v13.4.5v13.4.6v13.4.7v13.4.8v13.4.9 |
13.4.23 |
typo3/cms-recyclerPackagist |
12.0.0 up to 12.4.41, plus listed versions v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3 Show 43 moreShow lessv12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.11v12.4.12v12.4.13v12.4.14v12.4.15v12.4.16v12.4.17v12.4.18v12.4.19v12.4.2v12.4.20v12.4.21v12.4.22v12.4.23v12.4.24v12.4.25v12.4.26v12.4.27v12.4.28v12.4.29v12.4.3v12.4.30v12.4.31v12.4.32v12.4.33v12.4.34v12.4.35v12.4.36v12.4.37v12.4.38v12.4.39v12.4.4v12.4.40v12.4.5v12.4.6v12.4.7v12.4.8v12.4.9 |
12.4.41 |
typo3/cms-recyclerPackagist |
11.0.0 up to 11.5.49, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 Show 45 moreShow lessv11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.35v11.5.36v11.5.37v11.5.38v11.5.39v11.5.4v11.5.40v11.5.41v11.5.5v11.5.6v11.5.7v11.5.8 |
11.5.49 |
typo3/cms-recyclerPackagist |
10.0.0 up to 10.4.55, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 38 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.55 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59022 is a high vulnerability (CVSS 7.1) in Typo3, published January 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in typo3/cms-recycler 14.0.2.
References
typo3.org/security/advisory/typo3-core-sa-2026-003
github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20
nvd.nist.gov/vuln/detail/CVE-2025-59022
Left out here: 1 version. The JSON record has them.