CVE-2026-49741: TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

Synopsis

This vulnerability combines privilege escalation and SQL injection in TYPO3 CMS versions 14.0.0 through 14.3.2, affecting the Form Framework's persistence layer. An authenticated backend user with write access to the form_definition table can bypass the Form Framework's permission checks by sending crafted requests directly through DataHandler, re-enabling attack vectors previously addressed in 2018. Successful exploitation gives the attacker the ability to read and tamper with database contents and escalate their privileges within the CMS. A patched-image rebuild at version 14.3.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TYPO3 backend over the network to send crafted DataHandler requests.

• AuthenticationRequired

  A valid backend user account with write access to the form_definition table is needed; any low-privilege account meeting that table permission is sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker operates entirely through their own authenticated session.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to bypass the Form Framework's validation.

Blast Radius

• Reads arbitrary database rows, including stored session tokens, user credentials, and customer records, by injecting SQL through crafted form configurations.
• Modifies persisted database records, including form definitions and user permission entries, enabling lasting changes to CMS data.
• Escalates privileges within the TYPO3 backend by injecting configurations that re-enable access controls or roles beyond what the account was originally granted.
• Causes limited disruption to the form-serving layer (low availability impact on the vulnerable component) as a side effect of malformed definition injection.