PT-2026-41863 · Typo3 · Typo3

Christian Bülter + 1 · CVE-2026-46723 · Published 2026-05-19 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 (affected versions not specified)

Description The additional tables configuration of the page and tt content indexers allows the use of arbitrary table and field names. A backend user with permissions to edit indexer configurations can exploit this to copy sensitive data from internal tables into the search index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-46723

GHSA-67J3-JMM3-32XC

Affected Products

Typo3

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46723.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/tpwd/ke_search/CVE-2026-46723.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-67j3-jmm3-32xc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46723 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2026-011 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46723 · Vendor Advisory
• https://github.com/tpwd/ke_search · Note
• https://packagist.org · Note
• https://t.me/CVEtracker/54228 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056689145150337124 · Twitter Post