{"id":"GHSA-jh32-v29g-68pq","aliases":["CVE-2026-49741"],"title":"TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework","description":"### Problem\nBackend users with write access to the `form_definition` database table were able to directly create, update, or delete form definition records via `DataHandler`, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in [TYPO3-CORE-SA-2018-003](https://typo3.org/security/advisory/typo3-core-sa-2018-003), including SQL injection and privilege escalation.\n\n### Solution\nUpdate to TYPO3 version 14.3.3 LTS that fixes the problem described.\n\n### Credits\nTYPO3 CMS thanks Selçuk Güney for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.\n\n### Resources\n* [TYPO3-CORE-SA-2026-017](https://typo3.org/security/advisory/typo3-core-sa-2026-017)","severity":"high","score":8.7,"published":"2026-06-12T19:32:22.000Z","modified":"2026-09-10T03:51:08.836Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms-core","ranges":[{"events":[{"introduced":"14.0.0"},{"fixed":"14.3.3"}],"type":"ECOSYSTEM"}],"versions":["v14.0.0","v14.0.1","v14.0.2","v14.1.0","v14.1.1","v14.2.0","v14.3.0","v14.3.1","v14.3.2"],"fixed":["14.3.3"]},{"ecosystem":"Packagist","name":"typo3/cms-form","ranges":[{"events":[{"introduced":"14.0.0"},{"fixed":"14.3.3"}],"type":"ECOSYSTEM"}],"versions":["v14.0.0","v14.0.1","v14.0.2","v14.1.0","v14.1.1","v14.2.0","v14.3.0","v14.3.1","v14.3.2"],"fixed":["14.3.3"]}],"sourceAffected":[],"references":["https://github.com/TYPO3/typo3/security/advisories/GHSA-jh32-v29g-68pq","https://nvd.nist.gov/vuln/detail/CVE-2026-49741","https://github.com/TYPO3/typo3/commit/c90493c13b633f328cf2c066182c90a1655ff0fc","https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49741.yaml","https://github.com/TYPO3/typo3","https://typo3.org/security/advisory/typo3-core-sa-2018-003","https://typo3.org/security/advisory/typo3-core-sa-2026-017"],"sources":[{"name":"OSV","id":"GHSA-jh32-v29g-68pq","modified":"2026-09-10T03:51:08.836282130Z","url":"https://osv.dev/vulnerability/GHSA-jh32-v29g-68pq"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.7}]}