Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-59020
Good to know:
Date: January 13, 2026
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Incorrect Authorization
CWE-863Top Fix
Upgrade Version
Upgrade to version https://github.com/TYPO3/typo3.git - v10.4.55;https://github.com/TYPO3/typo3.git - v11.5.49;https://github.com/TYPO3/typo3.git - v12.4.41;https://github.com/TYPO3/typo3.git - v13.4.23;https://github.com/TYPO3/typo3.git - v14.0.2
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | LOW |
| Availability (A): | NONE |