CVE-2025-59020
Field-Level Access Bypass in TYPO3 CMS via defVals Parameter
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: TYPO3
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| typo3 | typo3_cms | to 10.4.54 (inc) |
| typo3 | typo3_cms | to 11.5.48 (inc) |
| typo3 | typo3_cms | to 12.4.40 (inc) |
| typo3 | typo3_cms | to 13.4.22 (inc) |
| typo3 | typo3_cms | to 14.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in TYPO3 CMS involves the 'defVals' parameter used during new content creation. Attackers could exploit 'defVals' to bypass field-level access controls, allowing them to insert arbitrary data into database fields that should be restricted. This happens because 'defVals' historically bypassed permission checks enforced by the FormEngine and DataHandler components, enabling unauthorized default values to be set on new records. The security fix ensures that 'defVals' are now processed through the DataHandler's permission checks, preventing unauthorized data injection. [1, 2, 4]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited write permissions to insert or modify data in database fields that are normally excluded or restricted. This means unauthorized data manipulation can occur during record creation in the TYPO3 backend, potentially compromising data integrity and security within the CMS. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-59020, immediately update your TYPO3 CMS installation to one of the fixed versions: 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, or 14.0.2. These updates include patches that enforce permission checks on the defVals parameter during record creation, preventing unauthorized data injection. Additionally, review backend user permissions and restrict access to sensitive fields to minimize risk until the update is applied. [3]