TYPO3 CMS Allows Broken Access Control in Edit Document Controller (TYPO3 TYPO3 CMS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.31 % · centile 24 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- TYPO3
- Statut NVD
- Analyzed
Description
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | TYPO3 |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-5j7q-wmh7-cqhg — TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Références européennes
- ENISA EUVD · EUVD-2026-2090
- GCVE · GCVE-0-2025-59020
Avis du CERT-FR
- CERTFR-2026-AVI-0037 — Multiples vulnérabilités dans Typo3 · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.4.55cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.5.49cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 12.0.0 < 12.4.41cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 13.0.0 < 13.4.23cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*≥ 14.0.0 < 14.0.2
Produits affectés
| Produit | Versions |
|---|---|
| TYPO3 · TYPO3 CMS | affected 10.0.0 < 10.4.55 ; affected 11.0.0 < 11.5.49 ; affected 12.0.0 < 12.4.41 ; affected 13.0.0 < 13.4.23 ; affected 14.0.0 < 14.0.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |