Executive brief
A vulnerability in the TYPO3 faceted fulltext search extension (ke_search) allows authorized backend users to access sensitive information they should not be able to see. By manipulating indexer configurations, a user can force the system to copy data from internal, restricted database tables into the public search index. This could lead to the exposure of sensitive administrative or customer data through search results.
Technical details
A vulnerability exists in the TYPO3 faceted fulltext search extension (ke_search) where the 'additional_tables' configuration for page and tt_content indexers fails to properly validate table and field names. An attacker with TYPO3 backend privileges to edit indexer configurations can specify arbitrary internal database tables. The indexer will then ingest data from these restricted tables into the search index, making sensitive information searchable and viewable. This is classified as an 'Exposure of Resource to Wrong Sphere' (CWE-668). The issue is resolved in versions 7.0.1, 6.6.1, 5.6.2, and 4.6.7.
Affected products
- tpwd ke_search >= 7.0.0, < 7.0.1; >= 6.0.0, < 6.6.1; >= 5.0.0, < 5.6.2; < 4.6.7
Timeline
- 2026-05-19: advisory
- 2026-05-19: disclosed
References
- https://api.github.com/users/eliashaeussler
- https://github.com/eliashaeussler
- https://api.github.com/users/eliashaeussler/gists%7B/gist_id%7D
- https://api.github.com/users/eliashaeussler/repos
- https://avatars.githubusercontent.com/u/16313625?v=4
- https://api.github.com/users/eliashaeussler/events%7B/privacy%7D