Executive brief
TYPO3 CMS is a popular open-source content management system used for building and managing websites. A security flaw in its Form Framework allows certain administrative users to bypass safety checks and modify form configurations in ways that should be restricted. This could lead to unauthorized access to sensitive data or the ability for an attacker to gain higher-level control over the website.
Technical details
A vulnerability exists in TYPO3 CMS where backend users with write access to the 'form_definition' database table can bypass the Form Framework's persistence validation and permission checks. By using the 'DataHandler' component to directly manipulate form records, an attacker can inject arbitrary form configurations. This flaw re-introduces legacy attack vectors, specifically SQL injection and privilege escalation, by circumventing the intended security architecture of the Form Framework. The issue is fixed in TYPO3 version 14.3.3 LTS.
Affected products
- TYPO3 cms-core >= 14.0.0, < 14.3.3
- TYPO3 cms-form >= 14.0.0, < 14.3.3
Timeline
- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-jh32-v29g-68pq
- https://github.com/TYPO3/typo3/commit/c90493c13b633f328cf2c066182c90a1655ff0fc
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49741.yaml
- https://typo3.org/security/advisory/typo3-core-sa-2018-003
- https://typo3.org/security/advisory/typo3-core-sa-2026-017