PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49741 TYPO3 CVE debrief

CVE-2026-49741 is a high-severity vulnerability in TYPO3 CMS versions 14.0.0-14.3.3. Backend users with write access to the form_definition database table could directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations and re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation.

Vendor
TYPO3
Product
TYPO3 CMS
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-07-15
Advisory published
2026-06-09
Advisory updated
2026-07-15

Who should care

Users of TYPO3 CMS versions 14.0.0-14.3.3, especially those with backend users who have write access to the form_definition database table.

Technical summary

The vulnerability has a CVSS score of 8.7 and is classified as HIGH. It affects TYPO3 CMS versions 14.0.0-14.3.3 and is related to CWE-89 and CWE-862.

Defensive priority

High

Recommended defensive actions

  • Update TYPO3 CMS to a version outside of the affected range (14.0.0-14.3.3).
  • Restrict write access to the form_definition database table to trusted backend users.
  • Monitor for suspicious activity related to form configurations and DataHandler usage.

Evidence notes

The CVE record and details can be found at [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-49741). The NVD detail page is available at [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-49741). Additional information can be found in the TYPO3 security advisories [typo3-core-sa-2018-003](https://typo3.org/security/advisory/typo3-core-sa-2018-003) and [typo3-core-sa-2026-017](https://typo3.org/security/advisory/typo3-core-sa-2026-017).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49741 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49741

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49741 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49741

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/TYPO3/typo3/commit/c90493c13b633f328cf2c066182c90a1655ff0fc

    f4fb688c-4412-4426-b4b8-421ecf27b14a

  • Source reference

    Unverified legacy reference

    URL: https://typo3.org/security/advisory/typo3-core-sa-2018-003

    f4fb688c-4412-4426-b4b8-421ecf27b14a

  • Source reference

    Unverified legacy reference

    URL: https://typo3.org/security/advisory/typo3-core-sa-2026-017

    f4fb688c-4412-4426-b4b8-421ecf27b14a

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.