deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wh92-6q6g-px7j
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Community Edition Improper Input Validation vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-wh92-6q6g-px7j
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.6-p1, <= 2.4.6-p12
Patched in: unpatched

Summary: Magento Community Edition Improper Input Validation vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-wh92-6q6g-px7j
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Community Edition Improper Input Validation vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-wh92-6q6g-px7j
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.4.5-p14
Patched in: unpatched

Summary: Magento Community Edition Improper Input Validation vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-72cm-7236-h43r
Package: datahihi1/tiny-env (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.0.9, < 1.0.11
Patched in: 1.0.11

Summary: TinyEnv: Inline comments not stripped properly in .env values

Details:
### Impact
TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including # or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication.

### Patches
Fixed in v1.0.11. Users should upgrade to the latest patched version.

### Workarounds
As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
GitHub Security Advisory: GHSA-3j7m-5g4q-gfpc
Package: datahihi1/tiny-env (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-703: Improper Check or Handling of Exceptional Conditions
Vulnerable versions: >= 1.0.9, < 1.0.11
Patched in: 1.0.11

Summary: TinyEnv: Missing .env file not required — may cause unexpected behavior

Details:
### Impact
TinyEnv did not require the `.env` file to exist when loading environment variables.  
This could lead to **unexpected behavior** where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.  

Affected versions:  
- **1.0.1 → 1.0.2**  
- **1.0.9 → 1.0.10**

### Patches
The issue has been fixed in **version 1.0.11**.  
All users should upgrade to `1.0.11` or later.

### Workarounds
As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example:

```php
if (!file_exists(__DIR__ . '/.env')) {
    throw new RuntimeException('.env file is missing!');
}
GitHub Security Advisory: GHSA-3j7m-5g4q-gfpc
Package: datahihi1/tiny-env (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-703: Improper Check or Handling of Exceptional Conditions
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: TinyEnv: Missing .env file not required — may cause unexpected behavior

Details:
### Impact
TinyEnv did not require the `.env` file to exist when loading environment variables.  
This could lead to **unexpected behavior** where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations.  

Affected versions:  
- **1.0.1 → 1.0.2**  
- **1.0.9 → 1.0.10**

### Patches
The issue has been fixed in **version 1.0.11**.  
All users should upgrade to `1.0.11` or later.

### Workarounds
As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example:

```php
if (!file_exists(__DIR__ . '/.env')) {
    throw new RuntimeException('.env file is missing!');
}
GitHub Security Advisory: GHSA-j8vm-7q52-2m2m
Package: typo3/cms-recordlist (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 CSV download feature information disclosure

Details:
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
GitHub Security Advisory: GHSA-j8vm-7q52-2m2m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 CSV download feature information disclosure

Details:
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
GitHub Security Advisory: GHSA-j8vm-7q52-2m2m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 CSV download feature information disclosure

Details:
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
GitHub Security Advisory: GHSA-w2pf-7q5w-2cgw
Package: typo3/cms-workspaces (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 Workspaces Module Information Disclosure

Details:
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
GitHub Security Advisory: GHSA-w2pf-7q5w-2cgw
Package: typo3/cms-workspaces (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 Workspaces Module Information Disclosure

Details:
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
GitHub Security Advisory: GHSA-w2pf-7q5w-2cgw
Package: typo3/cms-workspaces (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 Workspaces Module Information Disclosure

Details:
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
GitHub Security Advisory: GHSA-w2pf-7q5w-2cgw
Package: typo3/cms-workspaces (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 Workspaces Module Information Disclosure

Details:
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
GitHub Security Advisory: GHSA-w2pf-7q5w-2cgw
Package: typo3/cms-workspaces (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 Workspaces Module Information Disclosure

Details:
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-beuser (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-beuser (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-beuser (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-beuser (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-beuser (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-dashboard (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-dashboard (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-dashboard (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-dashboard (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-recycler (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-recycler (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-recycler (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-recycler (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-recycler (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-workspaces (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-workspaces (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-workspaces (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-workspaces (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-2fhw-2j7m-mr4m
Package: typo3/cms-workspaces (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 backend modules have Broken Access Control

Details:
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
GitHub Security Advisory: GHSA-cvm2-5f78-g9m8
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 CMS exposes sensitive information in an error message

Details:
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.