A missing authorization vulnerability in TYPO3 CMS allows authenticated backend users to perform unauthorized actions by invoking restricted AJAX routes.

This vulnerability involves a missing authorization check (CWE-862) within the backend routing component. It allows any authenticated backend user to execute AJAX requests for modules they are not otherwise authorized to access.

Successful exploitation of this flaw allows attackers with valid backend credentials to bypass intended access controls and interact with modules they should be restricted from. While the CVSS score of 8.8 indicates high severity, the requirement for existing, albeit lower-level, authentication limits the immediate scope to lateral movement within the administrative interface. This could lead to unauthorized data manipulation or information disclosure within the affected backend modules.

Immediate Action: Update the TYPO3 CMS installation to the latest patched versions as specified by the vendor, specifically versions 9.5.55, 10.4.54, 11.5.48, 12.4.37, or 13.4.18.

Proactive Monitoring: Review backend access logs for unusual AJAX activity or requests targeting modules that do not align with the assigned roles and permissions of the active user accounts.

Compensating Controls: Ensure that backend access is restricted to known, trusted IP addresses and enforce the principle of least privilege for all backend user accounts to minimize the potential impact of unauthorized module access.

Public Exploit Available: Unknown.

Organizations utilizing TYPO3 CMS should prioritize the application of the vendor-provided security patches immediately. Because this vulnerability allows for unauthorized access to administrative modules, prompt remediation is necessary to prevent potential privilege escalation or unauthorized administrative actions by compromised or malicious user accounts.