CVE-2026-46723 — Information Disclosure in extension "Faceted Search" (ke_search)

CVE-2026-46723

Information Disclosure in extension "Faceted Search" (ke_search) PUBLISHED

Description (CNA)

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "Faceted Search"	affected 7.0.0 before 7.0.1; affected 6.0.0 before 6.6.1; affected 0 before 5.6.2

CWE

CWE-668

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-011

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.