CVE-2025-59022
Published: 13 January 2026
Summary
CVE-2025-59022 is a high-severity Missing Authorization (CWE-862) vulnerability in Typo3 Typo3. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Destruction (T1485); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-59022 is a missing authorization vulnerability (CWE-862) in TYPO3 CMS, published on 2026-01-13. It enables backend users with access to the recycler module to delete arbitrary data from any database table defined in the TCA, bypassing permissions for those tables. This can purge critical site data and render the website unavailable. The issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1, with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Attackers require low privileges, specifically backend access to the recycler module, to exploit this remotely over the network with low complexity and no user interaction. Successful exploitation allows deletion of data across unauthorized database tables, leading to high-impact destruction of site content and denial of service by making the website unavailable.
The TYPO3 security advisory (TYPO3-CORE-SA-2026-003) details the issue and mitigation, with fixes available in GitHub commits including 336d6f165458a0ce32d8330999ab9ab6a5983d20, a6604db66499710f72ae6e7006beb14ad0913aae, and efb9528f9882ac924c40598ebd8508479e9950a3. Security practitioners should apply these patches or upgrade to unaffected versions immediately.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2088
Vulnerability details
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical…
more
site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in recycler module directly enables unauthorized deletion of arbitrary database tables (stored data manipulation) resulting in data destruction and site unavailability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of access control policies that directly prevent unauthorized deletions from database tables by backend users in the recycler module.
AC-6 least privilege restricts recycler module access to only necessary permissions, blocking deletions from unauthorized TCA-defined tables.
SI-2 flaw remediation requires applying TYPO3 patches that fix the missing authorization in the recycler module.