TYPO3 CMS CVE-2026-49741

Requires an authenticated TYPO3 backend account whose permissions include write access to the form_definition database table (a non-default permission that must be granted via backend user/group configuration). The target must be running TYPO3 CMS 14.0.0-14.3.3 with the Form Framework system extension enabled and the backend reachable to the attacker over the network. No user interaction by another user is required (UI:N), and no special non-default server configuration beyond standard Form Framework usage is needed. Limiting factors: hardened sites that restrict editor table permissions to only the tables they edit, sites that disable the Form system extension, and sites that gate backend access behind VPN/IP allowlists materially reduce exposure.

CVSS 4.0 of 8.7 with AV:N/AC:L/PR:L/UI:N reflects an attacker who already holds a low-privileged backend account and can reach the TYPO3 backend over the network - a realistic insider or post-phish scenario rather than an internet-wide exposure. Confidentiality and integrity are rated High (VC:H/VI:H) because the bypass yields SQLi and privilege escalation, with availability Low. There is no EPSS score or SSVC decision data in the input; no KEV listing and no public exploit identified, so this is currently a high-severity-but-not-mass-exploited issue. The non-trivial precondition (backend account with write access on form_definition) materially lowers real-world risk versus the headline score, but any TYPO3 site that grants editors broad table permissions, or that has previously been partially compromised, should treat this as a priority patch given the SQLi-to-privilege-escalation chain. Note: the description states the affected user must have 'write access to the form_definition database table,' which is more specific than the CVSS PR:L generally implies - defenders should map this to their backend group ACLs rather than assuming any authenticated user qualifies.

A low-privileged TYPO3 backend editor - either a malicious insider or an attacker who phished an editor account - opens the backend List module (or scripts the DataHandler endpoint directly) and submits a crafted form_definition record whose JSON configuration embeds malicious SQL or finisher/finisherOptions payloads. Because the write is processed by DataHandler rather than the Form persistence manager, validation and permission checks are skipped and the malicious form configuration is stored verbatim. The attacker then triggers form rendering or submission to execute the SQL injection, escalating to administrative privileges in line with the original TYPO3-CORE-SA-2018-003 attack class.