CVE-2026-112069 — Broken Access Control in extension "FAL Protect" (fal_protect)

CVE-2026-112069

Broken Access Control in extension "FAL Protect" (fal_protect) PUBLISHED

Description (CNA)

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "FAL Protect"	affected 1.7.1 before 1.8.2

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-028

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.