CVE-2026-11607 is a missing authorization vulnerability (CWE-862) in TYPO3 CMS's Form Framework. Backend users with access can exploit the acceptance of improperly suffixed form definition files to execute arbitrary SQL commands. This can lead to privilege escalation by creating administrative backend user accounts. The vulnerability affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2. The CVSS 4.0 base score is 7.6 (high severity), indicating network attack vector, low attack complexity, and partial privileges required.

Successful exploitation allows attackers with backend user access to escalate privileges by executing arbitrary SQL statements, including creating administrative backend user accounts. This compromises the integrity and security of the TYPO3 CMS installation by enabling unauthorized administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, restrict backend user access to trusted personnel only and monitor for suspicious activity related to form definitions. Follow vendor advisories closely for updates on remediation.