CVE-2025-59020: 
PHP vulnerability analysis and mitigation

CVE-2025-59020 is an incorrect authorization vulnerability (CWE-863) in the TYPO3 CMS Edit Document Controller, described as "Broken Access Control in Edit Document Controller." By exploiting the defVals URL parameter, authenticated backend users can bypass field-level access checks during record creation, inserting arbitrary data into prohibited "exclude" fields of database tables for which they already hold partial write permissions. Affected versions span TYPO3 CMS 10.0.0–10.4.54, 11.0.0–11.5.48, 12.0.0–12.4.40, 13.0.0–13.4.22, and 14.0.0–14.0.1. The vulnerability was published on January 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, TYPO3 Advisory).

The root cause is an incorrect authorization check (CWE-863) in EditDocumentController.php. Historically, the defVals parameter was designed to allow passing default field values for new record creation wizards, and was permitted to bypass TCEFORM.[tableName].[fieldName].disabled and readOnly settings. However, the vulnerable code passed defVals directly into DataHandler::$defaultValues — a trusted internal array that skips standard FormEngine and DataHandler permission checks — rather than routing it through the normal data map subject to access control enforcement. An attacker with low-privilege backend access could craft a request to the TYPO3 backend's record creation endpoint with a manipulated defVals query parameter containing values for fields they are not authorized to write. The fix routes defVals through the standard datamap instead, ensuring all existing permission checks are applied (GitHub Advisory, Patch Commit).

Successful exploitation allows authenticated backend users with limited write permissions to insert arbitrary data into database fields they are explicitly prohibited from modifying ("exclude fields"). The primary impact is on data integrity — an attacker could manipulate sensitive record attributes such as content type, layout positions, or other restricted metadata fields beyond their intended scope. There is no confidentiality or availability impact; the vulnerability is scoped to the vulnerable system's database integrity (GitHub Advisory, TYPO3 Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access to the TYPO3 backend with at least low-level write privileges to a database table, limiting the attack surface to trusted (but potentially malicious) backend users. The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a TYPO3 CMS installation running a vulnerable version (10.0.0–10.4.54, 11.0.0–11.5.48, 12.0.0–12.4.40, 13.0.0–13.4.22, or 14.0.0–14.0.1) and obtain backend credentials with at least limited write access to a database table.
2. Identify target fields: Determine which database table fields are configured as "exclude fields" (i.e., fields the attacker's backend user group is not permitted to write) by reviewing the TYPO3 TCA configuration or observing which fields are absent from the backend editing form.
3. Craft malicious request: Construct a backend URL targeting the Edit Document Controller's new record creation action (e.g., /typo3/record/edit?edit[tt_content][-1]=new) and append a defVals query parameter containing the prohibited field names and desired values, e.g., &defVals[tt_content][subheader]=injected_value&defVals[tt_content][hidden]=0.
4. Submit the request: Send the crafted GET or POST request to the TYPO3 backend while authenticated. The vulnerable code passes defVals directly to DataHandler::$defaultValues, bypassing FormEngine and DataHandler permission checks.
5. Verify data insertion: Confirm that the new record was created with the injected values in the prohibited fields by inspecting the database or the backend record view (GitHub Advisory, Patch Commit).

• Logs: TYPO3 backend access logs showing authenticated POST or GET requests to the record edit endpoint (e.g., /typo3/record/edit) with defVals query parameters containing field names that the requesting user should not have access to.
• Database: Unexpected or unauthorized values in "exclude field" columns of TYPO3 database tables (e.g., tt_content, pages) for records created by low-privilege backend users — particularly in fields such as subheader, hidden, or other fields restricted by backend group configuration.
• Logs: TYPO3 system log (sys_log table) entries showing record creation actions by backend users for tables/fields outside their normal permission scope.

TYPO3 has released patched versions addressing this vulnerability: 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, and 14.0.2. Administrators should upgrade to the appropriate patched version as soon as possible. As an interim measure, restrict TYPO3 backend access to only fully trusted users and audit backend user group permissions to minimize the set of users with any write access to sensitive tables. No configuration-only workaround is available that fully mitigates the vulnerability without upgrading (TYPO3 Advisory, GitHub Advisory).

The vulnerability was reported by Daniel Windloff and fixed by TYPO3 core and security team member Benjamin Franzke. TYPO3 published the official security advisory (TYPO3-CORE-SA-2026-001) on January 13, 2026, alongside the patched releases. Community coverage has been limited to standard vulnerability tracking platforms and aggregators; no significant independent researcher commentary or notable media coverage has been identified (TYPO3 Advisory, GitHub Advisory).