CVE-2025-59021: TYPO3 CMS Auth Bypass Vulnerability

CVE-2025-59021 Overview

A missing authorization vulnerability has been identified in the TYPO3 CMS redirects module that allows backend users with access to the redirects module and write permission on the sys_redirect table to read, create, and modify any redirect record without restriction to the user's own file-mounts or web-mounts. This broken access control flaw enables attackers to insert or alter redirects pointing to arbitrary URLs, facilitating phishing campaigns or other malicious redirect attacks.

Critical Impact

Authenticated backend users can manipulate redirect configurations across the entire TYPO3 installation, potentially redirecting legitimate traffic to malicious destinations for phishing or malware distribution.

Affected Products

• TYPO3 CMS versions 10.0.0 through 10.4.54
• TYPO3 CMS versions 11.0.0 through 11.5.48
• TYPO3 CMS versions 12.0.0 through 12.4.40
• TYPO3 CMS versions 13.0.0 through 13.4.22
• TYPO3 CMS versions 14.0.0 through 14.0.1

Discovery Timeline

• 2026-01-13 - CVE-2025-59021 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-59021

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The TYPO3 CMS redirects module failed to enforce proper access control checks when backend users interacted with the sys_redirect database table. Under normal operating conditions, TYPO3 backend users should only be able to manage redirects that fall within their assigned file-mounts and web-mounts, which are configured by administrators to limit each user's scope of access. However, due to the missing authorization checks, any authenticated backend user with module access could bypass these restrictions entirely.

The security impact extends beyond simple data access violations. By manipulating redirect records, an attacker could redirect visitors from legitimate internal pages to external phishing sites, effectively weaponizing the trusted TYPO3 installation against its own users. This is particularly dangerous in enterprise environments where multiple backend users with varying trust levels share the same TYPO3 instance.

Root Cause

The root cause of this vulnerability lies in the absence of permission guard mechanisms in the redirects module. The module did not properly validate whether a user had appropriate file-mount or web-mount permissions before allowing operations on redirect records. The security patches introduce a new RedirectPermissionGuard class that integrates with the BackendUserAuthentication system to verify user access rights before permitting any redirect operations.

Attack Vector

An attacker who has been granted legitimate backend access to TYPO3 (even with limited permissions) can exploit this vulnerability through the network. The attack requires:

1. Valid backend user credentials with access to the redirects module
2. Write permissions on the sys_redirect table

Once these prerequisites are met, the attacker can access the redirects module and modify any redirect record in the system, regardless of their configured mount restrictions. The low attack complexity means no special conditions or race windows need to be won for successful exploitation.

// Security patch introducing RedirectPermissionGuard (from TYPO3 commit)
<?php

declare(strict_types=1);

namespace TYPO3\CMS\Redirects\EventListener;

use TYPO3\CMS\Backend\Form\Event\ModifyEditFormUserAccessEvent;
use TYPO3\CMS\Core\Attribute\AsEventListener;
use TYPO3\CMS\Redirects\Security\RedirectPermissionGuard;

/**
 * @internal
 */
final readonly class RedirectEditPermissionGuard
{
    public function __construct(
        private RedirectPermissionGuard $redirectPermissionGuard,
    ) {}

Source: TYPO3 Security Commit

Detection Methods for CVE-2025-59021

Indicators of Compromise

• Unexpected or unauthorized entries in the sys_redirect database table
• Redirect records pointing to external domains not owned by the organization
• Redirect modifications made by users who should not have access to those specific site sections
• Audit log entries showing redirect module activity from users with limited mount permissions

Detection Strategies

• Review TYPO3 backend user access logs for unusual redirect module activity
• Implement database monitoring to detect changes to the sys_redirect table
• Configure alerts for new redirects pointing to external or unfamiliar domains
• Audit all redirect records periodically to identify unauthorized modifications

Monitoring Recommendations

• Enable detailed logging for the TYPO3 redirects module
• Monitor for bulk modifications to redirect records which may indicate exploitation
• Implement change detection on the sys_redirect table with alerting capabilities
• Review backend user permissions regularly to ensure principle of least privilege

How to Mitigate CVE-2025-59021

Immediate Actions Required

• Update TYPO3 CMS to the latest patched version for your major release branch
• Audit existing redirect records for any suspicious or unauthorized entries
• Review and restrict backend user access to the redirects module where possible
• Temporarily disable redirects module access for non-essential users until patches are applied

Patch Information

TYPO3 has released security patches addressing this vulnerability across all affected version branches. The patches introduce a new RedirectPermissionGuard class and SourceHostProvider that properly enforce file-mount and web-mount restrictions on redirect operations. For detailed patch information, refer to the TYPO3 Security Advisory and the related commits:

• Commit 8a46abd
• Commit bac370d
• Commit fbbae3b

Workarounds

• Remove write permissions on the sys_redirect table for non-administrative backend users
• Disable access to the redirects module entirely for users who do not require it
• Implement database-level access controls to restrict modifications to the sys_redirect table
• Deploy a Web Application Firewall (WAF) rule to monitor and log redirect module interactions

# Review current redirect records for suspicious entries
mysql -u typo3user -p typo3_database -e "SELECT uid, source_host, source_path, target, updatedon FROM sys_redirect ORDER BY updatedon DESC LIMIT 50;"

# Identify redirects pointing to external domains
mysql -u typo3user -p typo3_database -e "SELECT * FROM sys_redirect WHERE target LIKE 'http%' AND target NOT LIKE 'https://yourdomain.com%';"