5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46723

CVE-2026-46723: Information Disclosure in extension "Faceted Search" (ke_search)

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46723

CVE-2026-46723:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tpwd/ke_search	composer	>= 7.0.0, < 7.0.1	7.0.1
tpwd/ke_search	composer	>= 6.0.0, < 6.6.1	6.6.1
tpwd/ke_search	composer	>= 5.0.0, < 5.6.2	5.6.2
tpwd/ke_search	composer	< 4.6.7	4.6.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ke_search TYPO3 extension, where a backend user with permissions to edit indexer configurations can access and index data from arbitrary database tables. This is due to insufficient validation of the additional_tables configuration. The analysis of the patch for version 7.0.1 revealed that the parseAndProcessAdditionalTablesConfiguration function in Classes/Service/AdditionalContentService.php was modified to include a new validation check. The commit 112ff669aa7fc669a48911647a4f5e150a7ca443 introduces the isConfigAllowed method, which is called within parseAndProcessAdditionalTablesConfiguration before processing the table configuration. This new check ensures that the configured table and fields are permissible according to the TYPO3 Table Configuration Array (TCA), thus preventing unauthorized access to sensitive tables. The vulnerable function is parseAndProcessAdditionalTablesConfiguration as it was the entry point for the unvalidated configuration.

Vulnerable functions

Tpwd\KeSearch\Service\AdditionalContentService::parseAndProcessAdditionalTablesConfiguration

Classes/Service/AdditionalContentService.php

The function `parseAndProcessAdditionalTablesConfiguration` is vulnerable because it processes the `additional_tables` configuration from user input without properly validating whether the configured table is allowed to be accessed. An attacker with backend access could configure an arbitrary table, including sensitive ones, and have its data indexed by the search extension, leading to information disclosure. The patch adds a call to the new `isConfigAllowed` function to verify the table against the system's table configuration (TCA).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.