CVE-2025-59020: TYPO3 CMS Backend Allows Broken Access Control in Edit Document Controller
Summary
CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document Controller. Affects typo3/cms-backend across 5 version ranges.
>= 10.0.0, < 10.4.55
>= 11.0.0, < 11.5.49
>= 12.0.0, < 12.4.41
>= 13.0.0, < 13.4.23
>= 14.0.0, < 14.0.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust framework for developers and a user-friendly interface for content editors. TYPO3 provides features such as multi-language support, extensibility through plugins, and a flexible templating system. However, it is crucial to maintain its security, as vulnerabilities can lead to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from the exploitation of the 'defVals' parameter in the TYPO3 backend, which allows attackers to bypass field-level access checks during record creation. This flaw enables unauthorized users to insert arbitrary data into restricted fields of a database table, even if they only have write permissions for a limited set of fields. The implications of this vulnerability are significant, as it can lead to data corruption, unauthorized data exposure, and potential system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.4.5510.4.55composer require typo3/cms-backend:10.4.55 -
>= 11.0.0, < 11.5.4911.5.49composer require typo3/cms-backend:11.5.49 -
>= 12.0.0, < 12.4.4112.4.41composer require typo3/cms-backend:12.4.41 -
>= 13.0.0, < 13.4.2313.4.23composer require typo3/cms-backend:13.4.23 -
>= 14.0.0, < 14.0.214.0.2composer require typo3/cms-backend:14.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the necessary updates to the TYPO3 CMS as soon as possible.
Conclusion
The CVE-2025-59020 vulnerability in TYPO3 CMS poses a significant risk due to broken access control in the Edit Document Controller. It is crucial for users to update their installations to the latest patched versions to protect against potential exploitation.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2025-59020 is a vulnerability in TYPO3 CMS that allows broken access control in the Edit Document Controller, enabling unauthorized data manipulation.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your composer.lock file, Vulert can alert you to any vulnerabilities, including CVE-2025-59020.
Exploitation of this vulnerability can lead to unauthorized access to restricted fields, data corruption, and potential system compromise.
You can update TYPO3 using Composer with the command: composer require typo3/cms-backend:^14.0.2, replacing '14.0.2' with the appropriate patched version.
Currently, there are no specific workarounds available. It is recommended to apply the updates as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
