CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Problem By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields.
Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.
Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.
References TYPO3-CORE-SA-2026-001
Other sources
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59020?
CVE-2025-59020 has a high severity rating due to its ability to allow attackers to bypass access controls.
How do I fix CVE-2025-59020?
To fix CVE-2025-59020, update to the latest version of TYPO3 CMS that addresses this vulnerability.
Which versions of TYPO3 CMS are affected by CVE-2025-59020?
CVE-2025-59020 affects TYPO3 CMS versions from 10.0.0 to 10.4.54, 11.0.0 to 11.5.48, 12.0.0 to 12.4.40, 13.0.0 to 13.4.22, and 14.0.0 to 14.0.1.
What does CVE-2025-59020 exploit in TYPO3 CMS?
CVE-2025-59020 exploits the defVals parameter in the Edit Document Controller to bypass field-level access checks.
What risks does CVE-2025-59020 pose to TYPO3 CMS users?
CVE-2025-59020 poses risks of unauthorized data manipulation and potential data breaches due to broken access control.