EUVD-2026-30863
GHSA-67j3-jmm3-32xc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
AnalysisAI
Sensitive internal TYPO3 database content can be exfiltrated into the public search index via the Faceted Search extension's misconfigured additional_tables parameter. Backend users holding permission to edit indexer configurations can reference arbitrary internal database tables and fields - including those storing backend credentials, frontend user records, or other protected data - causing the search indexer to copy that data into the search index where it may be surfaced in search results or via API responses. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for high-privilege backend access (PR:H per CVSS 4.0), placing this firmly in insider-threat and privilege-misuse risk scenarios.
Technical ContextAI
TYPO3's Faceted Search extension provides configurable full-text search indexing for page and tt_content records. Indexer configurations include an additional_tables parameter designed to allow administrators to extend indexing to related database tables. The root cause, classified as CWE-668 (Exposure of Resource to Wrong Sphere), is the absence of an allowlist or access control layer restricting which tables and fields this parameter can target. Because TYPO3's internal database contains sensitive tables not intended for search exposure - such as be_users (backend user records including password hashes), fe_users (frontend user accounts), and various sys_* system tables - an unconstrained additional_tables value crosses the boundary between the administrative sphere and the public search sphere. The affected CPE is cpe:2.3:a:typo3:extension_faceted_search:*:*:*:*:*:*:*:*, indicating the extension across all tracked versions. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N) confirms network-accessible exploitation path but with present attack requirements and high-privilege prerequisite.
RemediationAI
Consult the TYPO3 security advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-011 and apply the patched version of the Faceted Search extension as directed; the exact fixed version must be obtained from the advisory as it was not confirmed in the available data. As an immediate compensating control, administrators should audit backend user role assignments and revoke permission to edit Faceted Search indexer configurations from any user who does not require it operationally - this directly eliminates the attack surface. Additionally, review all existing indexer configurations for unauthorized references to sensitive internal tables (be_users, fe_users, sys_*) in the additional_tables field and remove them. Search index contents should be audited and re-indexed after remediation to purge any previously exfiltrated sensitive data. Restricting Faceted Search indexer configuration access to a minimal set of trusted administrators is the most effective compensating control pending patching, with no meaningful functional side effects for normal site operation.
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vul
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today