CVE-2026-49741: TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
Problem Backend users with write access to the formdefinition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation.
Solution Update to TYPO3 version 14.3.3 LTS that fixes the problem described.
Credits TYPO3 CMS thanks Selçuk Güney for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.
Resources TYPO3-CORE-SA-2026-017
Other sources
Backend users with write access to the formdefinition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.
— MITRE
Backend users with write access to the formdefinition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.3.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 14.3.3Patch TYPO3-CORE-SA-2026-017
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49741?
CVE-2026-49741 has a severity rating of high with a CVSS score of 8.7.
How do I fix CVE-2026-49741?
To mitigate CVE-2026-49741, ensure that your Typo3 CMS is updated to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-49741?
CVE-2026-49741 is a privilege escalation and SQL injection vulnerability.
Who is affected by CVE-2026-49741?
Backend users of Typo3 CMS with write access to the form_definition database table are affected by CVE-2026-49741.
What can attackers achieve with CVE-2026-49741?
Attackers can use CVE-2026-49741 to inject arbitrary form configurations and bypass permission checks.