Vulnerability advisory

CVE-2025-59020

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

Published Jan 13, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/benjaminkott/bootstrap_package ↗
a9914eb78915ee33a47e4317637b3b03a692fe58 to before ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96	`ee7b28acd9e8b5f0c6eae34f67a67bcc68e0dc96`
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before 29ccb6fc4887fcb0f0ceac5bfd24d4993176c412	`29ccb6fc4887fcb0f0ceac5bfd24d4993176c412`
fd8745e46bb11773e85524b8ee9650dabe340713 to before ef75ec889ef10324e61df83ff994db67c4d45255	`ef75ec889ef10324e61df83ff994db67c4d45255`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before 62e93122ec75943aba5553b0aa1c6a50c4ccc27f	`62e93122ec75943aba5553b0aa1c6a50c4ccc27f`
Not specified	`ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b`
Not specified	`cd11a19958d823d12d028f9345b41739c7e70118`
Not specified	`fb98378a8fd30dd50d89a3d1a420780819f38232`
Also listed as affected (77) `14.0.1` `14.0.0` `v13.4.22` `v12.4.40` `v13.4.21` `v14.0.1` `v14.0.0` `v13.4.20` `v12.4.39` `v13.4.19` `v12.4.38` `v13.4.18` `v12.4.37` `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

By exploiting the defVals parameter, attackers could bypass field‐level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-59020

Affected versions

Repository

Description

References