Auth bypass in Typo3 Cms

CVE-2026-11607

Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used t…

Vulnerability class: Broken Access Control

EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.