CVE-2026-46723
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names.
Published May 19, 2026 · updated Jun 17, 2026
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 19, 2026 · NIST NVD
Detected
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Jun 17, 2026 · NIST NVD
Updated
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
Sources
- CVE.orgVulnerability recordCVE-2026-46723
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-46723
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
nvd.nist.gov