Security Vulnerability in TYPO3 CMS Affects Backend User Permissions

CVE-2026-49741

What is CVE-2026-49741?

A critical security issue exists in TYPO3 CMS that allows backend users with write access to manipulate form definition records directly through DataHandler. This bypasses the Form Framework's essential persistence validation and permission checks, enabling the injection of arbitrary form configurations. This raises the risk of SQL injection and privilege escalation attacks, jeopardizing the integrity and security of the system. This issue affects multiple versions, highlighting the need for immediate updates and patching to mitigate potential exploitation.

References