CVE-2025-59020

CVE-2025-59020: The 'Trust Me Bro' Vulnerability in TYPO3 CMS

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 14, 2026·7 min read·2 visits

Executive Summary (TL;DR)

TYPO3's EditDocumentController blindly trusted user-supplied default values (`defVals`) as internal system state. By injecting data into this parameter, low-privilege attackers can bypass the DataHandler's permission checks and modify restricted database fields (like system flags or access controls) during record creation.

A logic flaw in TYPO3's backend controller allows authenticated editors to bypass field-level permissions by disguising malicious input as 'system default values', effectively modifying data they are strictly forbidden from touching.

Official Patches

TYPO3TYPO3-CORE-SA-2026-001 Advisory
GitHubPatch Commit (Main)

Fix Analysis (1)

Technical Appendix

CVSS Score
5.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Probability
0.04%
Top 89% most exploited

Affected Systems

TYPO3 CMS 10.0.0 - 10.4.54TYPO3 CMS 11.0.0 - 11.5.48TYPO3 CMS 12.0.0 - 12.4.40TYPO3 CMS 13.0.0 - 13.4.22TYPO3 CMS 14.0.0 - 14.0.1

Affected Versions Detail

Product
Affected Versions
Fixed Version
TYPO3 CMS
TYPO3
>= 10.0.0, <= 10.4.5410.4.55
TYPO3 CMS
TYPO3
>= 11.0.0, <= 11.5.4811.5.49
TYPO3 CMS
TYPO3
>= 12.0.0, <= 12.4.4012.4.41
TYPO3 CMS
TYPO3
>= 13.0.0, <= 13.4.2213.4.23
TYPO3 CMS
TYPO3
>= 14.0.0, <= 14.0.114.0.2
AttributeDetail
Attack VectorNetwork (Authenticated)
CVSS v4.05.3 (Medium)
CWECWE-862 (Missing Authorization)
ImpactIntegrity Modification / ACL Bypass
EPSS Score0.00039
Exploit StatusPoC Available

MITRE ATT&CK Mapping

T1068Exploitation for Privilege Escalation
Privilege Escalation
T1211Exploitation for Defense Evasion
Defense Evasion
CWE-862
Missing Authorization

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Known Exploits & Detection

HypotheticalConstructed request: POST /typo3/record/edit?defVals[table][restricted_field]=value

Vulnerability Timeline

Vulnerability Disclosed
2026-01-13
Patch Released
2026-01-13
CVE Assigned
2026-01-13