CVE-2025-59020

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590216.4Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any r CVE-2025-590228.1Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of w CVE-2025-590238.2Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590246.5Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590256.1Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includi CVE-2025-590265.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-590287.5When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai CVE-2025-590295.3An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then CVE-2025-59038.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the CVE-2025-590307.5An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.CVE-2025-590314.3Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use CVE-2025-590327.5ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeated