VulnSocial

CVE-2026-49741Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-09); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-09: 1Mentions · 2026-06-16: 1Patch / Workaround · 2026-06-16: 1Technical Details · 2026-06-09: 1Technical Details · 2026-06-16: 106-0906-16
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-091
Disclosure1
2026-06-161
Patch1
Full discourse2 posts
  • Selçuk Güney@selcukgny
    Patch

    🚨 New CVE Alert! (CVE-2026-49741) Found a High Severity (CVSS 8.7) Privilege Escalation & SQLi vulnerability in @typo3 Core! Bypassed DataHandler validations to re-enable an old 2018 attack vector. Thanks to the TYPO3 sec team for the swift patch and bounty! 🤝 Official Advisory: https://news.typo3.com/security/advisory/typo3-core-sa-2026-017 #BugBounty #CVE #Infosec #TYPO3 #CyberSecurity

    Post summary

    The tweet announces CVE‑2026‑49741, a high‑severity privilege escalation and SQLi flaw in TYPO3 core, and notes a prompt patch and bounty, but does not provide a PoC or evidence of active exploitation.

    0000059
    42 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-49741 Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassi… https://www.cve.org/CVERecord?id=CVE-2026-49741

    Post summary

    The CVE describes a root‑level database tampering issue where backend users with write permissions can create, update, or delete form definitions through DataHandler, allowing potential unauthorized changes.

    00000112
    57.6K followersView on X

Explore more

Back to dashboard