low3.7
CVE-2025-47937
TYPO3 Allows Information Disclosure via DBAL Restriction Handling
Impact
### Problem When performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the last table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. ### Solution Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Christian Futterlieb for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | typo3/cms-core | >= 9.0.0, <= 9.5.50 | 9.5.51 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Typo3 | Typo3 | from 9.0.0 before 9.5.51 from 10.0.0 before 10.4.50 from 11.0.0 before 11.5.44 from 12.0.0 before 12.4.31 from 13.0.0 before 13.4.12 |