TYPO3 Form Framework Privilege Escalation & SQL Injection Vulnerability (CVE-2026-49741)

Vulnerability Overview Vulnerability Name: TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework Publication Date: June 9, 2026 Vulnerability Type: Privilege Escalation & SQL Injection Severity: High Affected Versions: 14.0.0–14.3.2 Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N References: CVE-2026-49741, CWE-83, CWE-862 Impact Scope If a backend user has write permissions to the database table, they can directly create, update, or delete form definition records. By exploiting the to bypass the form framework’s persistence validation and permission checks, an attacker can inject arbitrary form configurations. This re-enables attack vectors previously resolved in , including SQL injection and privilege escalation. Remediation Upgrade to TYPO3 version 14.3.3 LTS, which resolves the aforementioned issues. Additional Information Problem Description: Backend users can bypass the form framework’s persistence validation and permission checks via the , leading to SQL injection and privilege escalation. Solution: Upgrade to TYPO3 14.3.3 LTS. Acknowledgments: Thanks to Selçuk Güney for reporting this issue, and to Oliver Hader, a member of the TYPO3 Core and Security Team, for fixing it. General Advice: Follow the recommendations in the and subscribe to the mailing list. General Notes: All code changes related to security are tagged to facilitate easy finding within the . Author Information Author: Oliver Hader Position: TYPO3 Core Developer Company: TYPO3 GmbH, Hof, Germany Bio: Oliver has been using TYPO3 since 2005 and joined the TYPO3 Core Team in 2007. In 2014, he returned to university to pursue a graduate degree in Internet Network Science. Currently, he researches advanced networking technologies, specifically focusing on TYPO3. In his spare time, he enjoys cycling. Footer Information Copyright: © 2026 TYPO3 Association Legal: Legal Notice, Privacy Policy Slogan: Open. Sustainable. A Digital Public Good. Language Selection: Language

Goal Reached Thanks to every supporter — we hit 100%!

TYPO3 Form Framework Privilege Escalation & SQL Injection Vulnerability (CVE-2026-49741)