CVE-2026-46723
Information Disclosure in extension "Faceted Search" (ke_search)
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information Disclosure in extension "Faceted Search" (ke_search)
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
- Record
CVE-2026-46723- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-668
- Updated
- 2026-11-02
EUVDEUVD-2026-30863
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
- Record
EUVD-2026-30863- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-67j3-jmm3-32xc
TYPO3 ke_search path traversal from arbitrary table configuration input
In TYPO3 faceted fulltext search (ke_search), theadditional_tables configuration of the page and tt_content indexers accept arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-67j3-jmm3-32xc- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-668
- Updated
- 2026-11-02
NVD
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
- Record
CVE-2026-46723- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-668
- Updated
- 2026-11-02
OSV
Information Disclosure in extension "Faceted Search" (ke_search)
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
- Record
CVE-2026-46723- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVGHSA-67j3-jmm3-32xc
TYPO3 ke_search path traversal from arbitrary table configuration input
In TYPO3 faceted fulltext search (ke_search), theadditional_tables configuration of the page and tt_content indexers accept arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index. This has been patched in versions 7.0.1, 6.6.1, 5.6.2 and 4.6.7.
- Record
GHSA-67j3-jmm3-32xc- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-668
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1 | 7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1 | 6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2 | 5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7 | 4.6.7 |
tpwd/ke_searchPackagist |
7.0.0 up to 7.0.1, plus listed versions v7.0.0 |
7.0.1 |
tpwd/ke_searchPackagist |
6.0.0 up to 6.6.1, plus listed versions v6.0.0v6.0.1v6.1.0v6.1.1v6.1.2 Show 7 moreShow lessv6.1.3v6.2.0v6.3.0v6.4.0v6.4.1v6.5.0v6.6.0 |
6.6.1 |
tpwd/ke_searchPackagist |
5.0.0 up to 5.6.2, plus listed versions v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4 Show 15 moreShow lessv5.1.0v5.1.1v5.1.2v5.1.3v5.2.0v5.2.1v5.3.0v5.4.0v5.4.1v5.5.0v5.5.1v5.5.2v5.5.3v5.6.0v5.6.1 |
5.6.2 |
tpwd/ke_searchPackagist |
before 4.6.7, plus listed versions 1.99.01.99.21.99.41.99.51.99.7 Show 45 moreShow less2.0.02.0.12.0.22.0.32.0.42.1.02.2.02.2.14.0.2v2.3.0v2.3.1v2.4.0v2.4.1v2.4.2v2.5.0v2.6.0v2.6.1v2.6.2v2.6.3v2.7.0v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.1.0v3.1.1v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.2.0v3.3.0v3.3.1v3.4.0v3.4.1v3.4.2 |
4.6.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46723 is a medium vulnerability (CVSS 5.9) in Typo3 Extension "faceted Search", published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in tpwd/ke_search 7.0.1.
References
typo3.org/security/advisory/typo3-ext-sa-2026-011
nvd.nist.gov/vuln/detail/CVE-2026-46723
github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46723.yaml
packagist.org
Left out here: 31 versions. The JSON record has them.