Description (CNA)
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TYPO3 / TYPO3 CMS | affected 10.0.0 before 10.4.55; affected 11.0.0 before 11.5.49; affected 12.0.0 before 12.4.41; affected 13.0.0 before 13.4.23; affected 14.0.0 before 14.0.2 |
CWE
CWE-863
References
- https://typo3.org/security/advisory/typo3-core-sa-2026-001
- https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b
- https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232
- https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118
ADP enrichment
No English description supplied.
No references supplied.