CVE-2026-49741 Details

A vulnerability in the TYPO3 CMS Form Framework (ext:form) allows backend users with write access to the form_definition database table to bypass persistence validation and permission checks. This is achieved by directly manipulating form definition records through the DataHandler. The exploitation of this vulnerability enables the injection of arbitrary form configurations, potentially reintroducing previously addressed attack vectors, such as SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0 prior to 14.3.3.

Users are advised to update TYPO3 to version 14.3.3 LTS, which addresses this vulnerability by re-implementing the necessary guards and validation checks for form definitions.