CVE-2025-59020 json
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
published 2026-01-13 9 mo ago modified 2026-06-17 4 mo ago also GHSA-5j7q-wmh7-cqhg , EUVD-2026-2090
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Patch / fix
- packagist typo3/cms-backend 10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2
- TYPO3 TYPO3 CMS 10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2
- github.com/TYPO3/typo3@ac3f792 commit
- github.com/TYPO3/typo3@fb98378 commit
- github.com/TYPO3/typo3@cd11a19 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-backend | >=14.0.0, <14.0.2 >=13.0.0, <13.4.23 >=12.0.0, <12.4.41 >=11.0.0, <11.5.49 >=10.0.0, <10.4.55 |
14.0.2 13.4.23 12.4.41 11.5.49 10.4.55 |
Affected products
- TYPO3 TYPO3 CMS
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b
patch, web
-
github.com
/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232
patch, web
-
github.com
/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118
patch, web
-
typo3.org
/security/advisory/typo3-core-sa-2026-001
vendor-advisory, web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59020
advisory
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2025-59020
- GitHub Advisory GHSA-5j7q-wmh7-cqhg
- NVD CVE-2025-59020
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.