CVE-2026-49741

HighCVSS 8.7/10Last modified Jul 23, 2026

Description

Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-497427.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t CVE-2026-497437.8Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation obj CVE-2026-497447.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497457.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th CVE-2026-497467.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in cert CVE-2026-49758.8A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component P CVE-2026-497536.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint Mint allows attacker-controlle CVE-2026-497548.2Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust CVE-2026-497557.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to CVE-2026-497563.7Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attack CVE-2026-497579.2Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sig CVE-2026-497598.2Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by se