typo3-cms/core · Security
TYPO3 Allows Privilege Escalation to System Maintainer
- GHSA ID
- GHSA-6frx-j292-c844
- CVE ID
- CVE-2025-47940
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Problem
Administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account.
Solution
Update to TYPO3 versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.
Credits
Thanks to Alexander Künzl for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.
CWEs
- CWE-283 · Unverified Ownership
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-6frx-j292-c844 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-47940 ↗
- https://github.com/TYPO3-CMS/core/commit/a659cc8c0ae05c44dd7f01d13629cdd2d0b7219b ↗
- https://typo3.org/security/advisory/typo3-core-sa-2025-016 ↗
- https://github.com/advisories/GHSA-6frx-j292-c844 ↗