CVE-2026-11607: TYPO3 CMS Form Framework Broken Access Control Vulnerability
Summary
CVE-2026-11607: TYPO3 CMS has Broken Access Control in its Form Framework. Affects typo3/cms-core across 5 version ranges.
< 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is a popular open-source content management system (CMS) used for building and managing websites. It offers a robust Form Framework that allows users to create and manage forms easily. However, this framework has a critical vulnerability that allows unauthorized access to backend functionalities, potentially leading to privilege escalation.
Vulnerability Detail
The vulnerability arises from a broken access control mechanism in TYPO3's Form Framework. Backend users with access to this framework can exploit the system by using files that do not end with the '.form.yaml' extension as form definitions. This oversight allows attackers to process maliciously crafted files, which can execute arbitrary SQL statements. Consequently, this can lead to the creation of unauthorized administrative backend user accounts, significantly compromising the security of the TYPO3 installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.4.5710.4.57composer require typo3/cms-core:10.4.57 -
>= 11.0.0, < 11.5.5111.5.51composer require typo3/cms-core:11.5.51 -
>= 12.0.0, < 12.4.4612.4.46composer require typo3/cms-core:12.4.46 -
>= 13.0.0, < 13.4.3113.4.31composer require typo3/cms-core:13.4.31 -
>= 14.0.0, < 14.3.314.3.3composer require typo3/cms-core:14.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the Form Framework for backend users until the patch is applied. This can be done by modifying user permissions in the TYPO3 backend settings.
Conclusion
CVE-2026-11607 is a significant vulnerability in the TYPO3 CMS Form Framework that can lead to unauthorized access and privilege escalation. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for typo3/cms-core →
FAQ
CVE-2026-11607 is a vulnerability in the TYPO3 CMS Form Framework that allows unauthorized users to exploit the system through improperly validated form definition files.
If exploited, this vulnerability can allow attackers to execute arbitrary SQL statements, potentially leading to unauthorized access and privilege escalation within your TYPO3 installation.
The vulnerability affects TYPO3 versions prior to 10.4.57, 11.5.51, 12.4.46, 13.4.31, and 14.3.3.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The CVSS score for CVE-2026-11607 is 7.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
