CVE-2026-49741 is a missing authorization vulnerability in TYPO3 CMS affecting versions 14.0.0 through 14.3.2. Backend users with write access to the form_definition database table can manipulate form definition records directly via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This flaw allows injection of arbitrary form configurations, potentially re-enabling attack vectors such as SQL injection and privilege escalation that were previously mitigated in TYPO3-CORE-SA-2018-003. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity.

An attacker with backend write access to the form_definition table can bypass validation and permission controls to inject arbitrary form configurations. This can lead to reactivation of critical attack vectors including SQL injection and privilege escalation, compromising the integrity and security of the TYPO3 CMS installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Until a patch is available, restrict backend user permissions to prevent unauthorized write access to the form_definition database table.