Executive brief
Typesense is a high-performance search engine used to power search functionality on websites and applications. A security flaw in its caching system could allow users to see search results they are not authorized to view. This occurs when the system incorrectly reuses cached results from one user's restricted search for another user with different access permissions, potentially leading to the exposure of sensitive private data.
Technical details
A cache isolation vulnerability (CWE-524) exists in Typesense-server when server-side search result caching is enabled alongside Scoped Search API Keys. The root cause is improper partitioning of the search cache, allowing cached results to be served to different Scoped Search API Keys regardless of their unique embedded filter constraints. An attacker with a valid Scoped Search API Key could potentially retrieve sensitive data from a collection that should have been filtered out, provided the specific search query was previously cached by a request with broader permissions. The vulnerability is triggered by specific request ordering and affects versions prior to 29.1 and 30.2. Users are advised to upgrade or disable server-side caching for scoped requests as a workaround.
Affected products
- Typesense Typesense < 29.1, >= 30.0, < 30.2
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD