CVE-2026-11607: TYPO3 CMS - Broken Access Control in Form Framework

Synopsis

Broken access control in the TYPO3 CMS Form Framework allows an authenticated backend user to supply a maliciously crafted file as a form definition, bypassing the expected .form.yaml extension check. The vulnerability is reachable over the network and requires only a low-privilege backend account. Successful exploitation lets an attacker execute arbitrary SQL statements against the TYPO3 database, enabling privilege escalation by creating new administrative backend user accounts. Patched-image rebuilds at versions 10.4.57, 11.5.51, 12.4.46, 13.4.31, and 14.3.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TYPO3 backend over the network to deliver the malicious form definition file.

• AuthenticationRequired

  A low-privilege backend account with access to the Form Framework is sufficient; no administrative credentials are needed to begin the attack.

• Victim interactionNot required

  No victim interaction is needed; the attacker acts entirely through their own authenticated session.

• Attack complexityDetail

  Base exploit complexity is low, though the CVSS v4.0 vector notes an attack requirement (AT:P) meaning certain environmental or deployment conditions must align for the attack to succeed reliably.

Blast Radius

• Reads and queries arbitrary database tables, including user credentials, session tokens, and site configuration data stored in the TYPO3 database.
• Writes new administrative backend user accounts to the database, granting the attacker full TYPO3 backend access independent of the original compromised account.
• Modifies or deletes existing database rows, enabling tampering with content, user roles, and site settings.