The vulnerability allows backend users with write access to the form_definition table to create, update or delete form records via DataHandler, bypassing the Form Framework validation and permission checks. This bypass enables injection of arbitrary form configurations, allowing attackers to exploit previously fixed SQL injection paths and gain higher privileges. The issue is rooted in missing authorization checks and inadequate input validation, as categorized by CWE-862 and CWE-89.

TYPO3 CMS versions 14.0.0 through 14.3.3 are affected. All installations running these versions should verify whether backend users have write privileges to the form_definition database table, as the flaw only manifests when such permissions are granted.

The CVSS score of 8.7 indicates high severity, and the exploit is feasible for any backend user with write access, which is common in production environments that allow site editors or administrators. Because the flaw can enable both privilege escalation and SQL injection, an attacker can potentially compromise database integrity, gain read/write access, or execute arbitrary queries. No known public exploitation has been reported, and it is not listed in the CISA KEV catalog, but the EPSS score is not available, so the exact likelihood of exploitation remains uncertain. Nevertheless, the combination of high impact and the broad scope warrants prompt remediation.