Search for packages
| purl | pkg:composer/typo3/cms-backend@13.4.11 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5pry-8rnc-ubbh
Aliases: CVE-2025-47941 GHSA-744g-7qm9-hjh9 |
The TYPO3 CMS Backend has Broken Authentication in Backend MFA ### Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. ### Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. |
Affected by 2 other vulnerabilities. |
|
VCID-sjs5-c9c4-dfc6
Aliases: CVE-2025-59019 GHSA-j8vm-7q52-2m2m |
TYPO3 CSV download feature information disclosure Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. |
Affected by 1 other vulnerability. |
|
VCID-uvfp-uq3t-6ffg
Aliases: CVE-2025-59020 GHSA-5j7q-wmh7-cqhg |
TYPO3 CMS Allows Broken Access Control in Edit Document Controller ### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001) |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||