CVE-2025-59020 — Incorrect Authorization in CMS

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 98.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Typo3 CMSTypo3Typo3 Cms-backend
Timeline
PublishedJan 13

Description

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶Packagisttypo3/cms-backend14.0.0 — 14.0.2+4
▶NVDtypo3/typo310.0.0 — 10.4.55+4
▶CVEListV5typo3/typo3_cms10.0.0 — 10.4.55+4

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
TYPO3 CMS Allows Broken Access Control in Edit Document Controller↗2026-01-13
▶
GHSA
TYPO3 CMS Allows Broken Access Control in Edit Document Controller↗2026-01-13
▶
CVEList
TYPO3 CMS Allows Broken Access Control in Edit Document Controller↗2026-01-13
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-59020 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-59020 — Incorrect Authorization in Typo3 CMS | cvebase