The updated advisory indicates that backend users with write access to the form_definition database table can create, update, or delete form definitions directly through DataHandler, bypassing the Form Framework’s persistence validation and permission checks. Based on the description, it is inferred that this action permits arbitrary form configurations to be introduced, re‑enabling the SQL injection and privilege escalation vectors originally fixed in the earlier advisory. The flaw is rooted in missing authorization checks and insufficient input validation, corresponding to CWE‑862 and CWE‑89.

TYPO3 CMS versions 14.0.0 through 14.3.2 are affected. Installations running these releases should verify whether any backend user has write privileges to the form_definition database table, as the flaw manifests only when such permissions are granted.

The CVSS score of 8.7 indicates high severity, and the exploit is feasible for any backend user with write access, which is common in production environments that allow site editors or administrators. Based on the description, the likely attack vector involves a backend user with write access to the form_definition table manipulating form definitions via DataHandler. Because the flaw can enable both privilege escalation and SQL injection, an attacker can potentially compromise database integrity, gain read/write access, or execute arbitrary queries. No known public exploitation has been reported, and it is not listed in the CISA KEV catalog, but the EPSS score of 0.00244 indicates a very low, yet nonzero, probability of exploitation. Nonetheless, the high impact and broad scope are inferred to warrant prompt remediation.