Vulnerability record · CVE-2025-59020 · published 13 January 2026

CVE-2025-59020: Typo3 incorrect authorization vulnerability

Typo3 · Typo3

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

5.3 CVSS 4.0 Medium EPSS 0.31% · top 77.8% CWE-863 · Incorrect authorization

5.3CVSS 4.0 base score

0.31%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Typo3 Typo3

References

Link	Tags
https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b	Patch
https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118	Patch
https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232	Patch
https://typo3.org/security/advisory/typo3-core-sa-2026-001	Vendor Advisory

Track CVE-2025-59020 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-11066Typo3 mass assignment vulnerabilityIn TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on m…EPSS 1.5%14 May 2020 10.0CVE-2009-0258Typo3 improper input validation vulnerabilityThe Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote …EPSS 3.3%22 Jan 2009 9.8CVE-2011-3583Typo3 sql injection vulnerabilityIt was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a…EPSS 1.4%26 Nov 2019 9.8CVE-2011-4628Typo3 improper authentication vulnerabilityTYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a …EPSS 1.6%6 Nov 2019 8.8CVE-2024-55921Typo3 cross-site request forgery vulnerabilityTYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involvi…EPSS 0.36%14 Jan 2025 8.8CVE-2022-23503Typo3 code injection vulnerabilityTYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Cod…EPSS 0.81%14 Dec 2022 8.8CVE-2021-41113Typo3 cross-site request forgery vulnerabilityTYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature tha…EPSS 0.64%5 Oct 2021 8.8CVE-2020-15098Typo3 improper input validation vulnerabilityIn TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered th…EPSS 2.2%29 Jul 2020

Source: NIST National Vulnerability Database (record CVE-2025-59020), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.