# CVE-2025-59020: cms-backend — Fixed in 14.0.2 🐘 Packagist Not in CISA KEV # CVE-2025-59020 — cms-backend [Fix: TYPO3/typo3@ac3f792](https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b) CVE-2025-59020 is a CWE-863 vulnerability in typo3/cms-backend. A fix is available for typo3/cms-backend — see the affected versions and patch details below. TYPO3 CMS Allows Broken Access Control in Edit Document Controller Also known as[GHSA-5j7q-wmh7-cqhg](/vulnerability/GHSA-5j7q-wmh7-cqhg) Published Jan 13, 2026 Updated Oct 28, 2026 Affected 5 pkgs Patched 5 / 5 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-59020. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs24th percentile — riskier than 24% of all scored CVEsHighest risk 0.00%0.27%0.54%0.82%0.0%0.3%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 5 pkgs affected 🐘`typo3/cms-backend`🐘`typo3/cms-backend`🐘`typo3/cms-backend`🐘`typo3/cms-backend`🐘`typo3/cms-backend` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description #### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. #### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. #### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. #### References - [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001) ## Affected Packages 5 total 5 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `typo3/cms-backend` ≥ 14.0.0&&< 14.0.2 14.0.2`composer require typo3/cms-backend:^14.0.2` 🐘Packagist `typo3/cms-backend` ≥ 13.0.0&&< 13.4.23 13.4.23`composer require typo3/cms-backend:^13.4.23` 🐘Packagist `typo3/cms-backend` ≥ 12.0.0&&< 12.4.41 12.4.41`composer require typo3/cms-backend:^12.4.41` 🐘Packagist `typo3/cms-backend` ≥ 11.0.0&&< 11.5.49 11.5.49`composer require typo3/cms-backend:^11.5.49` 🐘Packagist `typo3/cms-backend` ≥ 10.0.0&&< 10.4.55 10.4.55`composer require typo3/cms-backend:^10.4.55` ## Affected Products 1 product · 5 configurations Application `typo3`typo3 ≥ 14.0.0 && < 14.0.2 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typo3/cms-backend, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update typo3/cms-backend to 14.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-59020 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \### Problem By exploiting the \`defVals\` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ### O3 Security · Impact-Aware SCA ### Is CVE-2025-59020 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)