Info Disclosure through Arbitrary Table Injection in TYPO3 Search Indexer
CVE-2026-46723 Published on May 19, 2026
Information Disclosure in extension "Faceted Search" (ke_search)
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Vulnerability Analysis
CVE-2026-46723 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected Versions
TYPO3 Extension "Faceted Search":- Version 7.0.0 and below 7.0.1 is affected.
- Version 6.0.0 and below 6.6.1 is affected.
- Before 5.6.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.