CVE-2026-11607High▾ TwilightTYPO3 CMS has Broken Access Control in its Form Framework
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts.
Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it.
typo3/cms-core < 10.4.57typo3/cms-core >= 11.0.0, < 11.5.51typo3/cms-core >= 12.0.0, < 12.4.46typo3/cms-core >= 13.0.0, < 13.4.31typo3/cms-core >= 14.0.0, < 14.3.3typo3/cms-form < 10.4.57typo3/cms-form >= 11.0.0, < 11.5.51typo3/cms-form >= 12.0.0, < 12.4.46typo3/cms-form >= 13.0.0, < 13.4.31typo3/cms-form >= 14.0.0, < 14.3.3Upgrade to a patched release:
typo3/cms-core 10.4.57typo3/cms-core 11.5.51typo3/cms-core 12.4.46typo3/cms-core 13.4.31typo3/cms-core 14.3.3typo3/cms-form 10.4.57typo3/cms-form 11.5.51typo3/cms-form 12.4.46typo3/cms-form 13.4.31typo3/cms-form 14.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47351MediumTYPO3 CMS: Broken Access Control in Media Module
CVE-2026-47352MediumTYPO3 CMS has Broken Access Control in Backend API
CVE-2026-47346HighTYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47350MediumTYPO3 CMS has Broken Access Control in its DataHandler
CVE-2026-49741HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-47343HighTYPO3 CMS: Destructive Actions on File Mount Folders