CVE-2025-47937: TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling
Problem When performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via FrontendGroupRestriction to the last table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users.
Solution Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.
Credits Thanks to Christian Futterlieb for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.
Other sources
TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via FrontendGroupRestriction to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47937?
CVE-2025-47937 has been classified as a high severity vulnerability due to its potential impact on database security.
How do I fix CVE-2025-47937?
To resolve CVE-2025-47937, update TYPO3 to version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS.
Which versions are affected by CVE-2025-47937?
CVE-2025-47937 affects TYPO3 versions starting from 9.0.0 up to 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS.
What type of vulnerability is CVE-2025-47937?
CVE-2025-47937 is a database query vulnerability involving multiple tables within TYPO3's database abstraction layer.
Is CVE-2025-47937 publicly known?
Yes, CVE-2025-47937 is a publicly disclosed vulnerability, allowing users and organizations to take necessary precautions.