CVE-2025-59020

Packagist/typo3/cms-backend CVE-2025-59020: medium, EPSS 0.31%

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

Action: Upgrade typo3/cms-backend to 10.4.55 or later.

composer require typo3/cms-backend:14.0.2

composer require typo3/cms-backend:13.4.23

composer require typo3/cms-backend:12.4.41

composer require typo3/cms-backend:11.5.49

composer require typo3/cms-backend:10.4.55

Affected

Fixed versions

Sources

• osv: GHSA-5j7q-wmh7-cqhg
• https://github.com/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg
• https://nvd.nist.gov/vuln/detail/CVE-2025-59020
• https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b
• https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118
• https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232
• https://github.com/TYPO3/typo3
• https://typo3.org/security/advisory/typo3-core-sa-2026-001

CVE-2025-59020 · published 2026-01-13T20:37:30Z · modified 2026-02-03T02:59:49.378236Z · JSON