TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Backend User Module” allows attackers to initiate password resets for other backend users or to terminate their user sessions. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.

• https://github.com/TYPO3-CMS/beuser/commit/18603efc3a66d3255fdd04eb6bda6b4d6a95abea
• https://github.com/TYPO3-CMS/beuser/commit/1bb317cb2bc0b2f6ba4f758a088f060b36c67f9d
• https://github.com/TYPO3-CMS/beuser/commit/4142112a878f8805234729751bc6b9c0091560ab
• https://github.com/TYPO3/typo3/security/advisories/GHSA-6w4x-gcx3-8p7v
• https://typo3.org/security/advisory/typo3-core-sa-2025-004

• Typo3 » Typo3 » Version: 10.0.0
  cpe:2.3:a:typo3:typo3:10.0.0
• Typo3 » Typo3 » Version: 10.0.10
  cpe:2.3:a:typo3:typo3:10.0.10
• Typo3 » Typo3 » Version: 10.0.9
  cpe:2.3:a:typo3:typo3:10.0.9
• Typo3 » Typo3 » Version: 10.1.0
  cpe:2.3:a:typo3:typo3:10.1.0
• Typo3 » Typo3 » Version: 10.2.0
  cpe:2.3:a:typo3:typo3:10.2.0
• Typo3 » Typo3 » Version: 10.2.1
  cpe:2.3:a:typo3:typo3:10.2.1
• Typo3 » Typo3 » Version: 10.2.2
  cpe:2.3:a:typo3:typo3:10.2.2
• Typo3 » Typo3 » Version: 10.3.0
  cpe:2.3:a:typo3:typo3:10.3.0
• Typo3 » Typo3 » Version: 10.4.0
  cpe:2.3:a:typo3:typo3:10.4.0
• Typo3 » Typo3 » Version: 10.4.1
  cpe:2.3:a:typo3:typo3:10.4.1
• Typo3 » Typo3 » Version: 10.4.10
  cpe:2.3:a:typo3:typo3:10.4.10
• Typo3 » Typo3 » Version: 10.4.11
  cpe:2.3:a:typo3:typo3:10.4.11
• Typo3 » Typo3 » Version: 10.4.12
  cpe:2.3:a:typo3:typo3:10.4.12
• Typo3 » Typo3 » Version: 10.4.13
  cpe:2.3:a:typo3:typo3:10.4.13
• Typo3 » Typo3 » Version: 10.4.14
  cpe:2.3:a:typo3:typo3:10.4.14
• Typo3 » Typo3 » Version: 10.4.15
  cpe:2.3:a:typo3:typo3:10.4.15
• Typo3 » Typo3 » Version: 10.4.16
  cpe:2.3:a:typo3:typo3:10.4.16
• Typo3 » Typo3 » Version: 10.4.17
  cpe:2.3:a:typo3:typo3:10.4.17
• Typo3 » Typo3 » Version: 10.4.18
  cpe:2.3:a:typo3:typo3:10.4.18
• Typo3 » Typo3 » Version: 10.4.19
  cpe:2.3:a:typo3:typo3:10.4.19
• Typo3 » Typo3 » Version: 10.4.2
  cpe:2.3:a:typo3:typo3:10.4.2
• Typo3 » Typo3 » Version: 10.4.20
  cpe:2.3:a:typo3:typo3:10.4.20
• Typo3 » Typo3 » Version: 10.4.21
  cpe:2.3:a:typo3:typo3:10.4.21
• Typo3 » Typo3 » Version: 10.4.22
  cpe:2.3:a:typo3:typo3:10.4.22
• Typo3 » Typo3 » Version: 10.4.23
  cpe:2.3:a:typo3:typo3:10.4.23
• Typo3 » Typo3 » Version: 10.4.24
  cpe:2.3:a:typo3:typo3:10.4.24
• Typo3 » Typo3 » Version: 10.4.25
  cpe:2.3:a:typo3:typo3:10.4.25
• Typo3 » Typo3 » Version: 10.4.26
  cpe:2.3:a:typo3:typo3:10.4.26
• Typo3 » Typo3 » Version: 10.4.27
  cpe:2.3:a:typo3:typo3:10.4.27
• Typo3 » Typo3 » Version: 10.4.28
  cpe:2.3:a:typo3:typo3:10.4.28
• Typo3 » Typo3 » Version: 10.4.29
  cpe:2.3:a:typo3:typo3:10.4.29
• Typo3 » Typo3 » Version: 10.4.3
  cpe:2.3:a:typo3:typo3:10.4.3
• Typo3 » Typo3 » Version: 10.4.30
  cpe:2.3:a:typo3:typo3:10.4.30
• Typo3 » Typo3 » Version: 10.4.31
  cpe:2.3:a:typo3:typo3:10.4.31
• Typo3 » Typo3 » Version: 10.4.32
  cpe:2.3:a:typo3:typo3:10.4.32
• Typo3 » Typo3 » Version: 10.4.33
  cpe:2.3:a:typo3:typo3:10.4.33
• Typo3 » Typo3 » Version: 10.4.34
  cpe:2.3:a:typo3:typo3:10.4.34
• Typo3 » Typo3 » Version: 10.4.35
  cpe:2.3:a:typo3:typo3:10.4.35
• Typo3 » Typo3 » Version: 10.4.36
  cpe:2.3:a:typo3:typo3:10.4.36
• Typo3 » Typo3 » Version: 10.4.37
  cpe:2.3:a:typo3:typo3:10.4.37
• Typo3 » Typo3 » Version: 10.4.39
  cpe:2.3:a:typo3:typo3:10.4.39
• Typo3 » Typo3 » Version: 10.4.4
  cpe:2.3:a:typo3:typo3:10.4.4
• Typo3 » Typo3 » Version: 10.4.40
  cpe:2.3:a:typo3:typo3:10.4.40
• Typo3 » Typo3 » Version: 10.4.41
  cpe:2.3:a:typo3:typo3:10.4.41
• Typo3 » Typo3 » Version: 10.4.5
  cpe:2.3:a:typo3:typo3:10.4.5
• Typo3 » Typo3 » Version: 10.4.6
  cpe:2.3:a:typo3:typo3:10.4.6
• Typo3 » Typo3 » Version: 10.4.7
  cpe:2.3:a:typo3:typo3:10.4.7
• Typo3 » Typo3 » Version: 10.4.8
  cpe:2.3:a:typo3:typo3:10.4.8
• Typo3 » Typo3 » Version: 10.4.9
  cpe:2.3:a:typo3:typo3:10.4.9
• Typo3 » Typo3 » Version: 11.0.0
  cpe:2.3:a:typo3:typo3:11.0.0
• Typo3 » Typo3 » Version: 11.0.2
  cpe:2.3:a:typo3:typo3:11.0.2
• Typo3 » Typo3 » Version: 11.0.3
  cpe:2.3:a:typo3:typo3:11.0.3
• Typo3 » Typo3 » Version: 11.1.0
  cpe:2.3:a:typo3:typo3:11.1.0
• Typo3 » Typo3 » Version: 11.1.1
  cpe:2.3:a:typo3:typo3:11.1.1
• Typo3 » Typo3 » Version: 11.2.0
  cpe:2.3:a:typo3:typo3:11.2.0
• Typo3 » Typo3 » Version: 11.3.0
  cpe:2.3:a:typo3:typo3:11.3.0
• Typo3 » Typo3 » Version: 11.3.1
  cpe:2.3:a:typo3:typo3:11.3.1
• Typo3 » Typo3 » Version: 11.3.2
  cpe:2.3:a:typo3:typo3:11.3.2
• Typo3 » Typo3 » Version: 11.3.3
  cpe:2.3:a:typo3:typo3:11.3.3
• Typo3 » Typo3 » Version: 11.4.0
  cpe:2.3:a:typo3:typo3:11.4.0
• Typo3 » Typo3 » Version: 11.5.0
  cpe:2.3:a:typo3:typo3:11.5.0
• Typo3 » Typo3 » Version: 11.5.1
  cpe:2.3:a:typo3:typo3:11.5.1
• Typo3 » Typo3 » Version: 11.5.10
  cpe:2.3:a:typo3:typo3:11.5.10
• Typo3 » Typo3 » Version: 11.5.11
  cpe:2.3:a:typo3:typo3:11.5.11
• Typo3 » Typo3 » Version: 11.5.12
  cpe:2.3:a:typo3:typo3:11.5.12
• Typo3 » Typo3 » Version: 11.5.13
  cpe:2.3:a:typo3:typo3:11.5.13
• Typo3 » Typo3 » Version: 11.5.14
  cpe:2.3:a:typo3:typo3:11.5.14
• Typo3 » Typo3 » Version: 11.5.15
  cpe:2.3:a:typo3:typo3:11.5.15
• Typo3 » Typo3 » Version: 11.5.16
  cpe:2.3:a:typo3:typo3:11.5.16
• Typo3 » Typo3 » Version: 11.5.17
  cpe:2.3:a:typo3:typo3:11.5.17
• Typo3 » Typo3 » Version: 11.5.18
  cpe:2.3:a:typo3:typo3:11.5.18
• Typo3 » Typo3 » Version: 11.5.19
  cpe:2.3:a:typo3:typo3:11.5.19
• Typo3 » Typo3 » Version: 11.5.2
  cpe:2.3:a:typo3:typo3:11.5.2
• Typo3 » Typo3 » Version: 11.5.20
  cpe:2.3:a:typo3:typo3:11.5.20
• Typo3 » Typo3 » Version: 11.5.21
  cpe:2.3:a:typo3:typo3:11.5.21
• Typo3 » Typo3 » Version: 11.5.22
  cpe:2.3:a:typo3:typo3:11.5.22
• Typo3 » Typo3 » Version: 11.5.23
  cpe:2.3:a:typo3:typo3:11.5.23
• Typo3 » Typo3 » Version: 11.5.24
  cpe:2.3:a:typo3:typo3:11.5.24
• Typo3 » Typo3 » Version: 11.5.25
  cpe:2.3:a:typo3:typo3:11.5.25
• Typo3 » Typo3 » Version: 11.5.26
  cpe:2.3:a:typo3:typo3:11.5.26
• Typo3 » Typo3 » Version: 11.5.27
  cpe:2.3:a:typo3:typo3:11.5.27
• Typo3 » Typo3 » Version: 11.5.28
  cpe:2.3:a:typo3:typo3:11.5.28
• Typo3 » Typo3 » Version: 11.5.29
  cpe:2.3:a:typo3:typo3:11.5.29
• Typo3 » Typo3 » Version: 11.5.3
  cpe:2.3:a:typo3:typo3:11.5.3
• Typo3 » Typo3 » Version: 11.5.30
  cpe:2.3:a:typo3:typo3:11.5.30
• Typo3 » Typo3 » Version: 11.5.31
  cpe:2.3:a:typo3:typo3:11.5.31
• Typo3 » Typo3 » Version: 11.5.32
  cpe:2.3:a:typo3:typo3:11.5.32
• Typo3 » Typo3 » Version: 11.5.33
  cpe:2.3:a:typo3:typo3:11.5.33
• Typo3 » Typo3 » Version: 11.5.34
  cpe:2.3:a:typo3:typo3:11.5.34
• Typo3 » Typo3 » Version: 11.5.35
  cpe:2.3:a:typo3:typo3:11.5.35
• Typo3 » Typo3 » Version: 11.5.36
  cpe:2.3:a:typo3:typo3:11.5.36
• Typo3 » Typo3 » Version: 11.5.37
  cpe:2.3:a:typo3:typo3:11.5.37
• Typo3 » Typo3 » Version: 11.5.38
  cpe:2.3:a:typo3:typo3:11.5.38
• Typo3 » Typo3 » Version: 11.5.39
  cpe:2.3:a:typo3:typo3:11.5.39
• Typo3 » Typo3 » Version: 11.5.4
  cpe:2.3:a:typo3:typo3:11.5.4
• Typo3 » Typo3 » Version: 11.5.40
  cpe:2.3:a:typo3:typo3:11.5.40
• Typo3 » Typo3 » Version: 11.5.41
  cpe:2.3:a:typo3:typo3:11.5.41
• Typo3 » Typo3 » Version: 11.5.5
  cpe:2.3:a:typo3:typo3:11.5.5
• Typo3 » Typo3 » Version: 11.5.6
  cpe:2.3:a:typo3:typo3:11.5.6
• Typo3 » Typo3 » Version: 11.5.7
  cpe:2.3:a:typo3:typo3:11.5.7
• Typo3 » Typo3 » Version: 11.5.8
  cpe:2.3:a:typo3:typo3:11.5.8
• Typo3 » Typo3 » Version: 11.5.9
  cpe:2.3:a:typo3:typo3:11.5.9
• Typo3 » Typo3 » Version: 12.0.0
  cpe:2.3:a:typo3:typo3:12.0.0
• Typo3 » Typo3 » Version: 12.1.0
  cpe:2.3:a:typo3:typo3:12.1.0
• Typo3 » Typo3 » Version: 12.1.1
  cpe:2.3:a:typo3:typo3:12.1.1
• Typo3 » Typo3 » Version: 12.1.2
  cpe:2.3:a:typo3:typo3:12.1.2
• Typo3 » Typo3 » Version: 12.1.3
  cpe:2.3:a:typo3:typo3:12.1.3
• Typo3 » Typo3 » Version: 12.2.0
  cpe:2.3:a:typo3:typo3:12.2.0
• Typo3 » Typo3 » Version: 12.3.0
  cpe:2.3:a:typo3:typo3:12.3.0
• Typo3 » Typo3 » Version: 12.4.0
  cpe:2.3:a:typo3:typo3:12.4.0
• Typo3 » Typo3 » Version: 12.4.1
  cpe:2.3:a:typo3:typo3:12.4.1
• Typo3 » Typo3 » Version: 12.4.10
  cpe:2.3:a:typo3:typo3:12.4.10
• Typo3 » Typo3 » Version: 12.4.11
  cpe:2.3:a:typo3:typo3:12.4.11
• Typo3 » Typo3 » Version: 12.4.12
  cpe:2.3:a:typo3:typo3:12.4.12
• Typo3 » Typo3 » Version: 12.4.13
  cpe:2.3:a:typo3:typo3:12.4.13
• Typo3 » Typo3 » Version: 12.4.14
  cpe:2.3:a:typo3:typo3:12.4.14
• Typo3 » Typo3 » Version: 12.4.15
  cpe:2.3:a:typo3:typo3:12.4.15
• Typo3 » Typo3 » Version: 12.4.16
  cpe:2.3:a:typo3:typo3:12.4.16
• Typo3 » Typo3 » Version: 12.4.17
  cpe:2.3:a:typo3:typo3:12.4.17
• Typo3 » Typo3 » Version: 12.4.18
  cpe:2.3:a:typo3:typo3:12.4.18
• Typo3 » Typo3 » Version: 12.4.19
  cpe:2.3:a:typo3:typo3:12.4.19
• Typo3 » Typo3 » Version: 12.4.2
  cpe:2.3:a:typo3:typo3:12.4.2
• Typo3 » Typo3 » Version: 12.4.20
  cpe:2.3:a:typo3:typo3:12.4.20
• Typo3 » Typo3 » Version: 12.4.21
  cpe:2.3:a:typo3:typo3:12.4.21
• Typo3 » Typo3 » Version: 12.4.22
  cpe:2.3:a:typo3:typo3:12.4.22
• Typo3 » Typo3 » Version: 12.4.23
  cpe:2.3:a:typo3:typo3:12.4.23
• Typo3 » Typo3 » Version: 12.4.24
  cpe:2.3:a:typo3:typo3:12.4.24
• Typo3 » Typo3 » Version: 12.4.3
  cpe:2.3:a:typo3:typo3:12.4.3
• Typo3 » Typo3 » Version: 12.4.4
  cpe:2.3:a:typo3:typo3:12.4.4
• Typo3 » Typo3 » Version: 12.4.5
  cpe:2.3:a:typo3:typo3:12.4.5
• Typo3 » Typo3 » Version: 12.4.6
  cpe:2.3:a:typo3:typo3:12.4.6
• Typo3 » Typo3 » Version: 12.4.7
  cpe:2.3:a:typo3:typo3:12.4.7
• Typo3 » Typo3 » Version: 12.4.8
  cpe:2.3:a:typo3:typo3:12.4.8
• Typo3 » Typo3 » Version: 12.4.9
  cpe:2.3:a:typo3:typo3:12.4.9
• Typo3 » Typo3 » Version: 13.0.0
  cpe:2.3:a:typo3:typo3:13.0.0
• Typo3 » Typo3 » Version: 13.0.1
  cpe:2.3:a:typo3:typo3:13.0.1
• Typo3 » Typo3 » Version: 13.1.0
  cpe:2.3:a:typo3:typo3:13.1.0
• Typo3 » Typo3 » Version: 13.1.1
  cpe:2.3:a:typo3:typo3:13.1.1
• Typo3 » Typo3 » Version: 13.2.0
  cpe:2.3:a:typo3:typo3:13.2.0
• Typo3 » Typo3 » Version: 13.2.1
  cpe:2.3:a:typo3:typo3:13.2.1
• Typo3 » Typo3 » Version: 13.3.0
  cpe:2.3:a:typo3:typo3:13.3.0
• Typo3 » Typo3 » Version: 13.3.1
  cpe:2.3:a:typo3:typo3:13.3.1
• Typo3 » Typo3 » Version: 13.4.0
  cpe:2.3:a:typo3:typo3:13.4.0
• Typo3 » Typo3 » Version: 13.4.1
  cpe:2.3:a:typo3:typo3:13.4.1
• Typo3 » Typo3 » Version: 13.4.2
  cpe:2.3:a:typo3:typo3:13.4.2