CVE-2026-49741 is a missing authorization vulnerability in TYPO3 CMS affecting versions 14.0.0 through 14.3.3. Backend users who have write access to the form_definition database table can manipulate form definition records directly through DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allows injection of arbitrary form configurations and re-enables attack vectors previously mitigated in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. The vulnerability has a high CVSS 4.0 score of 8.7, indicating significant impact potential. No official patch or remediation level is currently stated in the vendor advisory or data provided.

Exploitation allows backend users with write access to the form_definition table to bypass authorization controls, enabling unauthorized creation, modification, or deletion of form definitions. This can lead to injection of malicious configurations, potentially resulting in SQL injection attacks and privilege escalation within TYPO3 CMS. The vulnerability undermines previously implemented security measures, increasing risk to system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write access to the form_definition database table to trusted administrators only. Monitor TYPO3 vendor communications for updates regarding patches or official mitigations.