What is the CVSS score of CVE-2025-59022?

CVE-2025-59022 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Typo3 are affected by CVE-2025-59022?

CVE-2025-59022 presents notable security risk, a missing authorization vulnerability rated CVSS 8.1.. A patch is available.

How to fix or mitigate CVE-2025-59022?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Typo3 CVE-2025-59022

HIGH

Missing Authorization (CWE-862)

2026-01-13 f4fb688c-4412-4426-b4b8-421ecf27b14a

GHSA-p52w-7rhw-9m67

Typo3

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 14, 2026 - 19:07 nvd

Patch available

CVE Published

Jan 13, 2026 - 12:15 nvd

HIGH 8.1

DescriptionCVE.org

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

AnalysisAI

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Typo3. Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

CVE-2025-59022 vulnerability details – vuln.today

Back