Field-Level Access Bypass in TYPO3 CMS by TYPO3 Association

CVE-2025-59020

What is CVE-2025-59020?

This vulnerability allows attackers to exploit the defVals parameter in TYPO3 CMS, potentially bypassing field-level access checks during record creation in the backend. This could enable unauthorized insertion of arbitrary data into restricted exclude fields within a database table, so long as the user retains write permissions for a limited selection of fields. As a result, sensitive data may be compromised or corrupted, affecting the integrity and confidentiality of the information stored. Systems running versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1 are impacted by this issue.

References