CVE-2026-49741

TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

State: Published
Severity: 8.7 High
Published: Jun 9, 2026
Updated: Jul 15, 2026
Reserved: Jun 1, 2026

Description

Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-862 Missing Authorization
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
TYPO3 CMSTYPO3	14.0.0 to before 14.3.3Affected

References

https://typo3.org/security/advisory/typo3-core-sa-2026-017vendor-advisory
https://typo3.org/security/advisory/typo3-core-sa-2018-003related
Git commit of main branchpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.